CVE-2025-21908

NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback

MEDIUM
5.5
CVSS Score
Published: April 1, 2025 at 03:40 PM UTC
Updated: June 17, 2026 at 08:44 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd. Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back to NFS (which triggers writeback to NFSD via NFS loopback mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio): 6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds. {--- [58] "kcompactd0" [<0>] folio_wait_bit+0xe8/0x200 [<0>] folio_wait_writeback+0x2b/0x80 [<0>] nfs_wb_folio+0x80/0x1b0 [nfs] [<0>] nfs_release_folio+0x68/0x130 [nfs] [<0>] split_huge_page_to_list_to_order+0x362/0x840 [<0>] migrate_pages_batch+0x43d/0xb90 [<0>] migrate_pages_sync+0x9a/0x240 [<0>] migrate_pages+0x93c/0x9f0 [<0>] compact_zone+0x8e2/0x1030 [<0>] compact_node+0xdb/0x120 [<0>] kcompactd+0x121/0x2e0 [<0>] kthread+0xcf/0x100 [<0>] ret_from_fork+0x31/0x40 [<0>] ret_from_fork_asm+0x1a/0x30 ---} [[email protected]: fix build]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.13 ≤ v < 6.13.76.3 ≤ v < 6.12.196.3 ≤ v < 6.13.76.3 ≤ v < 6.146.3 ≤ v < 6.6.836.7 ≤ v < 6.12.196.14 rc16.14 rc26.14 rc36.14 rc46.14 rc596780ca55e3cbf4f150fd5a833a61492c9947b5b
Vendor states this is fixed in 5ae31c54cff745832b9bd5b32e71f3d1b607cd1e (fixed)
Vendor states this is fixed in 8253ff29edcb429a9a6c75710941c6a16a9a34b1 (fixed)
Vendor states this is fixed in ab0727d6e2196682351c25c1dd112136f6991f11 (fixed)
Vendor states this is fixed in ce6d9c1c2b5cc785016faa11b48b6cd317eb367e (fixed)
Vendor states this is fixed in 6.12.19 (unaffected)
Vendor states this is fixed in 6.13.7 (unaffected)
Vendor states this is fixed in 6.14 (unaffected)
Vendor states this is fixed in 6.3 (unaffected)
Vendor states this is fixed in 6.6.83 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5ae31c54cff745832b9bd5b32e71f3d1b607cd1e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8253ff29edcb429a9a6c75710941c6a16a9a34b1
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ab0727d6e2196682351c25c1dd112136f6991f11
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ce6d9c1c2b5cc785016faa11b48b6cd317eb367e

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUMCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-667

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card