CVE-2025-39912: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39912 is a Linux kernel vulnerability in the NFS local I/O (nfs/localio) subsystem where credentials are not properly restored before releasing page I/O data. If the nfsd filecache code releases the nfsd_file immediately, it can trigger a BUG_ON(cred == current->cred) assertion in __put_cred() when it dereferences nfsd_file->nf_file->f_cred, potentially causing a kernel panic. The vulnerability was published on October 1, 2025, and affects Linux kernel versions 6.12.x before 6.12.48 and 6.13.x through 6.16.x before 6.16.8, as well as release candidates 6.17-rc1 through 6.17-rc5. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper sequencing of credential restoration in the NFS local I/O path (CWE-672: Operation on a Resource after Expiration or Release). When NFS local I/O completes page I/O operations, the code must restore the original process credentials before releasing the associated pageio data structures. If the nfsd_file is released immediately by the filecache layer before credentials are restored, the __put_cred() function encounters a credential mismatch and triggers a kernel BUG_ON() assertion. Exploitation requires local access with low privileges and no user interaction, as the condition can be triggered through normal NFS file operations on an affected system (Red Hat Bugzilla, Kernel Patch 1).

Successful exploitation causes a kernel panic (BUG_ON() assertion failure), resulting in a system crash and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Systems running NFS services with local I/O enabled are most at risk, and a local user with minimal privileges could crash the kernel, affecting all processes and services on the host (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (CVSS PR:L), limiting the attack surface to authenticated local users or processes. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Advisory).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG_ON assertion failures in __put_cred() or stack traces referencing nfs/localio or nfsd_file release paths.
• System Behavior: Unexpected kernel panics or system reboots on hosts running NFS services with local I/O enabled.
• Process: Kernel oops or crash dumps referencing __put_cred, nfsd_file, or nfs_pageio in the backtrace.

Update the Linux kernel to a patched version: 6.12.48 or later for the 6.12.x stable branch, or 6.16.8 or later for the 6.13–6.16.x range. Patches have been committed to the stable kernel tree. As a temporary workaround, restricting local user access to systems running NFS services and monitoring kernel logs for credential-related errors can reduce risk. Apply updates from official distribution repositories (e.g., Red Hat, Ubuntu, SUSE) as they become available (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).