CVE-2025-39924

CVE-2025-39924

High · published October 1, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
2.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix invalid algorithm for encoded extents

The current algorithm sanity checks do not properly apply to new

encoded extents.

Unify the algorithm check with Z_EROFS_COMPRESSION(_RUNTIME)_MAX

and ensure consistency with sbi->available_compr_algs.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00137 · 2.8th percentile
Published
2025-10-01T12:15Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 6.15, < 6.16.86.16.8
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
https://git.kernel.org/stable/c/131897c65e2b86cf14bec7379f44aa8fbb407526 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/db5d7abd379a8dcf030be8f52f99cadf7e397ba8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 01 OCT 08:07Z
    erofs: fix invalid algorithm for encoded extents
    cvelistv5