CVE-2025-22036

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix random stack corruption after get_block

When get_block is called with a buffer_head allocated on the stack, such as do_mpage_readpage, stack corruption due to buffer_head UAF may occur in the following race condition situation.

 <CPU 0>                      <CPU 1>

mpage_read_folio <<bh on stack>> do_mpage_readpage exfat_get_block bh_read __bh_read get_bh(bh) submit_bh wait_on_buffer ... end_buffer_read_sync __end_buffer_read_notouch unlock_buffer <<keep going>> ... ... ... ... <<bh is not valid out of mpage_read_folio>> . . another_function <<variable A on stack>> put_bh(bh) atomic_dec(bh->b_count)

• stack corruption here *

This patch returns -EAGAIN if a folio does not have buffers when bh_read needs to be called. By doing this, the caller can fallback to functions like block_read_full_folio(), create a buffer_head in the folio, and then call get_block again.

Let's do not call bh_read() with on-stack buffer_head.

This vulnerability is rated as Moderate severity because exploitation requires local access to interact with an exFAT filesystem and relies on winning a timing-dependent race condition to induce stack corruption and a denial of service (system crash). Unprivileged users cannot trigger this condition unless allowed to mount removable exFAT media or read files from an existing exFAT partition. Additionally, earlier enterprise releases including Red Hat Enterprise Linux 8 and 9 do not contain the upstream commit that introduced this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.