CVE-2025-37999 is a vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) file I/O subsystem. The flaw arises from improper handling of bio_add_folio() failures during asynchronous I/O operations. Specifically, when bio_add_folio() fails because the bio structure is full, the code attempts to submit the current I/O request and allocate a new bio structure before retrying bio_add_folio(). However, erofs_onlinefolio_split() is called prematurely before confirming bio_add_folio() success, which increments a reference counter (folio->private) without a corresponding decrement. This results in the folio remaining locked indefinitely, causing any processes waiting on this folio to hang in folio_wait_bit_common(). The root cause was introduced by a commit that added support for unencoded inodes but was practically unreachable due to a large bio capacity (256 folios). A subsequent commit reduced the bio capacity to 16 folios, making it trivial to trigger the bug, for example by invoking readahead from userspace via posix_fadvise(). The fix involves calling erofs_onlinefolio_split() only after bio_add_folio() succeeds, ensuring proper reference counting and unlocking of folios. This vulnerability can cause a denial of service (DoS) by hanging processes that access EROFS-mounted filesystems under specific conditions. No known exploits are currently reported in the wild, and the vulnerability affects Linux kernel versions containing the specified commits.

For European organizations relying on Linux systems with EROFS-mounted filesystems, this vulnerability poses a risk of local denial of service. Applications or services performing aggressive readahead or asynchronous I/O on EROFS volumes could trigger the bug, causing processes to hang indefinitely. This can degrade system availability, impact critical services, and complicate troubleshooting. While the vulnerability does not appear to allow privilege escalation or remote code execution, the resulting DoS can disrupt operations, especially in environments with automated file access patterns or containerized workloads using EROFS. Given Linux's widespread use in European data centers, cloud infrastructure, and embedded devices, the impact could be significant in sectors such as telecommunications, finance, and public services where uptime is critical. The lack of known exploits reduces immediate risk, but the ease of triggering the bug via standard system calls suggests potential for exploitation in unpatched systems.

European organizations should prioritize updating Linux kernels to versions that include the fix for CVE-2025-37999. Kernel maintainers have corrected the code to call erofs_onlinefolio_split() only after bio_add_folio() succeeds, preventing folio lockups. Until patches are applied, administrators should monitor systems using EROFS mounts for symptoms such as hung processes or I/O stalls, especially following readahead operations. Limiting or disabling aggressive readahead on EROFS filesystems can reduce exposure. Additionally, auditing and restricting user-space applications that perform manual readahead (e.g., via posix_fadvise()) on EROFS volumes can mitigate risk. For environments using containerization or virtualization, ensure host kernels are patched since guest kernels may rely on host I/O. Implementing robust monitoring and alerting for I/O hangs and process stalls will aid in early detection. Finally, organizations should maintain an inventory of systems using EROFS to prioritize patching and risk assessment.