Slab Out-of-Bounds Write Vulnerability in Linux Kernel Affecting Fuse

CVE-2025-39888

What is CVE-2025-39888?

A vulnerability has been identified in the Linux kernel's FUSE subsystem, where a slab out-of-bounds write can occur in the 'fuse_dev_do_write' function. This issue arises when the amount of data to be retrieved exceeds the set limit defined by the 'fc->max_pages' parameter while also having an offset. Such conditions can lead to severe memory corruption and instability. The vulnerability has been patched by introducing a loop termination condition to prevent any potential overrun scenarios. It is crucial for system administrators to apply the latest updates to mitigate the risk associated with this vulnerability.

References