Trending
CVE-2025-39782

CVE detail

CVE-2025-39782

In the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup. watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace: native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2] __ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20 So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup.

CVSS 5.5 · MediumBuzz score 42.9

Buzz score

Why this CVE is surfacing

Buzz score total 42.9

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 26.4 · diversity 16.5 · KEV 0.0 · OTX 0.0 · PoC 0.0

Mention score

26.4

13 evidence mentions in the snapshot

Diversity score

16.5

4 sources across 3 categories

KEV score

0.0

No KEV entry observed

OTX score

0.0

0 OTX pulses

PoC score

0.0

0 repos · best confidence N/A

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 1; within the 30d window
Peak daily: 1; highest bucket

Evidence

Source links by recency

Newest mentions first

13 source links · newest first

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFPCISA Alerts
00 CPU 1518(F)-4 PN/DP MFP are affected: SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) vers:intdot/>=3.1.6 (CVE-2021-41617, CVE-2023-28531, CVE-2023-51384, CVE-2023-52927, CVE-2024-26783, CVE-2024-27056, CVE-2024-28956, CVE-2024-36903, CVE-2024-36927, CVE-2024-42079, CVE-2024-46786, CVE-2024-47736, CVE-2024-47809, CVE-2024-49968, CVE-2024-4
governmentwww.cisa.govJul 28, 2026, 12:00 PM
https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlcert-portal.siemens.com
No excerpt available.
Vendor Advisorycert-portal.siemens.comSep 11, 2025, 5:15 PM
https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlcert-portal.siemens.com
No excerpt available.
Vendor Advisorycert-portal.siemens.comSep 11, 2025, 5:15 PM
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmllists.debian.org
No excerpt available.
Vendor Advisorylists.debian.orgSep 11, 2025, 5:15 PM
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmllists.debian.org
No excerpt available.
Vendor Advisorylists.debian.orgSep 11, 2025, 5:15 PM
https://git.kernel.org/stable/c/f7ee8fd689e6d534f9fd2494b9266f7998082e65git.kernel.org
No excerpt available.
Exploitgit.kernel.orgSep 11, 2025, 5:15 PM
https://git.kernel.org/stable/c/f683d611518d30334813eecf9a8c687453e2800egit.kernel.org
No excerpt available.
Exploitgit.kernel.orgSep 11, 2025, 5:15 PM
https://git.kernel.org/stable/c/9d98cf4632258720f18265a058e62fde120c0151git.kernel.org
No excerpt available.
Exploitgit.kernel.orgSep 11, 2025, 5:15 PM
https://git.kernel.org/stable/c/84ff98c1ea19acd3f9389e4bb6061364e943f85egit.kernel.org
No excerpt available.
Exploitgit.kernel.orgSep 11, 2025, 5:15 PM
https://git.kernel.org/stable/c/429d50cbaff45090d52a1ea850d5de8c14881ee7git.kernel.org
No excerpt available.
Exploitgit.kernel.orgSep 11, 2025, 5:15 PM
https://git.kernel.org/stable/c/41f40038de62e8306897cf6840791b268996432agit.kernel.org
No excerpt available.
Exploitgit.kernel.orgSep 11, 2025, 5:15 PM
https://git.kernel.org/stable/c/3faac5e1d14c63260fd1bf789d96bde3ab3d9e54git.kernel.org
No excerpt available.
Exploitgit.kernel.orgSep 11, 2025, 5:15 PM
https://git.kernel.org/stable/c/26cb9aad94cb1811d8fae115594cc71fa3d91ab0git.kernel.org
No excerpt available.
Exploitgit.kernel.orgSep 11, 2025, 5:15 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars

No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2025-39885
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaph…
CVSS 5.5 · Medium
9 mentions
CVE-2025-39843
In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue i…
CVSS 5.5 · Medium
7 mentions
CVE-2025-39773
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large val…
CVSS 5.5 · Medium
11 mentions
CVE-2025-39736
In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_war…
CVSS 5.5 · Medium
12 mentions
CVE-2025-38711
In the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfEx…
CVSS 5.5 · Medium
9 mentions
CVE-2025-38650
In the Linux kernel, the following vulnerability has been resolved: hfsplus: remove mutex_lock check in hfsplus_free_extents Syzbot reported an issue in hfsplus filesystem: ---…
CVSS 5.5 · Medium
11 mentions

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2025-39782.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:o:debian:debian_linuxSearch this product on Shodan
cpe:2.3:o:linux:linux_kernelSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2025-39782Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Modified

Published

Sep 11, 2025

Modified

Jul 14, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE IDs

Vendor classifications

How this vector reads

CVSS 3.1 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Local. The attacker needs local access to the vulnerable system.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Privileges Required (PR): Low. The attacker needs basic user-level privileges.
User Interaction (UI): None. Exploitation does not require another user to act.
Scope (S): Unchanged. Impacts remain within the vulnerable security authority.
Confidentiality Impact (C): None. There is no direct impact to this security property.
Integrity Impact (I): None. There is no direct impact to this security property.
Availability Impact (A): High. There is a total or serious impact to this security property.

Signals

Exploitation indicators

0 stored signals · no KEV · 0 OTX pulses