CVE-2025-39888

An out-of-bounds write vulnerability exists in the linux kernel, such that in fuse_dev_do_write, when the number of bytes to be retrieved is truncated to the upper limit by fc->max_pages and there is an offset, the OOB is triggered.

A moderate-impact out-of-bounds write flaw was found in the Linux kernel's FUSE (Filesystem in Userspace) implementation. In fuse_dev_do_write(), when the number of bytes to be retrieved is truncated to the upper limit imposed by fc->max_pages and a non-zero offset is applied, the copy loop can run past the end of the allocated folio, causing a slab-out-of-bounds write in kernel memory, as reported by syzkaller. A local user with limited privileges could potentially use this flaw to corrupt kernel memory, resulting in a system crash or other unspecified impact; exploitation is assessed as having high attack complexity (Red Hat CVSS 3.1 score 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The upstream fix adds a loop termination condition to prevent the overrun. The assessed Red Hat Enterprise Linux 7, 8, 9, and 10 and Red Hat In-Vehicle OS kernel and kernel-rt streams are not affected because the vulnerable code is not present in the shipped kernels; the Red Hat Enterprise Linux 6 ELS stream is out of support scope. Upstream rates this issue higher (CVSS 3.1 score 7.8 with lower attack complexity); Red Hat's Moderate impact rating reflects the higher attack complexity and the constrained local conditions required for exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria, comprising ease of use and deployment, applicability to widespread installation base or stability.