CVE-2025-21721

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21721
In the Linux kernel, the following vulnerability has been resolved: nilfs2: handle errors that nilfs_prepare_chunk() may return Patch series "nilfs2: fix issues with rename operations". This series fixes BUG_ON check failures reported by syzbot around rename operations, and a minor behavioral issue where the mtime of a child directory changes when it is renamed instead of moved. This patch (of 2): The directory manipulation routines nilfs_set_link() and nilfs_delete_entry() rewrite the directory entry in the folio/page previously read by nilfs_find_entry(), so error handling is omitted on the assumption that nilfs_prepare_chunk(), which prepares the buffer for rewriting, will always succeed for these. And if an error is returned, it triggers the legacy BUG_ON() checks in each routine. This assumption is wrong, as proven by syzbot: the buffer layer called by nilfs_prepare_chunk() may call nilfs_get_block() if necessary, which may fail due to metadata corruption or other reasons. This has been there all along, but improved sanity checks and error handling may have made it more reproducible in fuzzing tests. Fix this issue by adding missing error paths in nilfs_set_link(), nilfs_delete_entry(), and their caller nilfs_rename().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1ee2d454baa361d2964e3e2f2cca9ee3f769d93c Patch
https://git.kernel.org/stable/c/481136234dfe96c7f92770829bec6111c7c5f5dd Patch
https://git.kernel.org/stable/c/607dc724b162f4452dc768865e578c1a509a1c8c Patch
https://git.kernel.org/stable/c/7891ac3b0a5c56f7148af507306308ab841cdc31 Patch
https://git.kernel.org/stable/c/b38c6c260c2415c7f0968871305e7a093daabb4c Patch
https://git.kernel.org/stable/c/eddd3176b8c4c83a46ab974574cda7c3dfe09388 Patch
https://git.kernel.org/stable/c/ee70999a988b8abc3490609142f50ebaa8344432 Patch
https://git.kernel.org/stable/c/f70bd2d8ca454e0ed78970f72147ca321dbaa015 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 Oct 2025, 13:06

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/1ee2d454baa361d2964e3e2f2cca9ee3f769d93c - () https://git.kernel.org/stable/c/1ee2d454baa361d2964e3e2f2cca9ee3f769d93c - Patch
References () https://git.kernel.org/stable/c/481136234dfe96c7f92770829bec6111c7c5f5dd - () https://git.kernel.org/stable/c/481136234dfe96c7f92770829bec6111c7c5f5dd - Patch
References () https://git.kernel.org/stable/c/607dc724b162f4452dc768865e578c1a509a1c8c - () https://git.kernel.org/stable/c/607dc724b162f4452dc768865e578c1a509a1c8c - Patch
References () https://git.kernel.org/stable/c/7891ac3b0a5c56f7148af507306308ab841cdc31 - () https://git.kernel.org/stable/c/7891ac3b0a5c56f7148af507306308ab841cdc31 - Patch
References () https://git.kernel.org/stable/c/b38c6c260c2415c7f0968871305e7a093daabb4c - () https://git.kernel.org/stable/c/b38c6c260c2415c7f0968871305e7a093daabb4c - Patch
References () https://git.kernel.org/stable/c/eddd3176b8c4c83a46ab974574cda7c3dfe09388 - () https://git.kernel.org/stable/c/eddd3176b8c4c83a46ab974574cda7c3dfe09388 - Patch
References () https://git.kernel.org/stable/c/ee70999a988b8abc3490609142f50ebaa8344432 - () https://git.kernel.org/stable/c/ee70999a988b8abc3490609142f50ebaa8344432 - Patch
References () https://git.kernel.org/stable/c/f70bd2d8ca454e0ed78970f72147ca321dbaa015 - () https://git.kernel.org/stable/c/f70bd2d8ca454e0ed78970f72147ca321dbaa015 - Patch
First Time Linux
Linux linux Kernel
CWE CWE-617
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

13 Mar 2025, 13:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: manejar errores que nilfs_prepare_chunk() puede devolver Serie de parches "nilfs2: soluciona problemas con operaciones de cambio de nombre". Esta serie corrige los fallos de comprobación BUG_ON informados por syzbot en torno a las operaciones de cambio de nombre, y un problema de comportamiento menor en el que el mtime de un directorio secundario cambia cuando se le cambia el nombre en lugar de moverlo. Este parche (de 2): Las rutinas de manipulación de directorios nilfs_set_link() y nilfs_delete_entry() reescriben la entrada del directorio en el folio/página leído previamente por nilfs_find_entry(), por lo que se omite el manejo de errores asumiendo que nilfs_prepare_chunk(), que prepara el búfer para la reescritura, siempre tendrá éxito para estos. Y si se devuelve un error, activa las comprobaciones BUG_ON() heredadas en cada rutina. Esta suposición es errónea, como lo demuestra syzbot: la capa de búfer llamada por nilfs_prepare_chunk() puede llamar a nilfs_get_block() si es necesario, lo que puede fallar debido a la corrupción de metadatos u otras razones. Esto ha estado ahí desde siempre, pero las comprobaciones de cordura mejoradas y el manejo de errores pueden haberlo hecho más reproducible en pruebas de fuzzing. Solucione este problema agregando rutas de error faltantes en nilfs_set_link(), nilfs_delete_entry() y su llamador nilfs_rename().
References
  • () https://git.kernel.org/stable/c/1ee2d454baa361d2964e3e2f2cca9ee3f769d93c -
  • () https://git.kernel.org/stable/c/607dc724b162f4452dc768865e578c1a509a1c8c -
  • () https://git.kernel.org/stable/c/b38c6c260c2415c7f0968871305e7a093daabb4c -
  • () https://git.kernel.org/stable/c/f70bd2d8ca454e0ed78970f72147ca321dbaa015 -

27 Feb 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/7891ac3b0a5c56f7148af507306308ab841cdc31 -

27 Feb 2025, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 02:15

Updated : 2025-10-23 13:06

NVD link : CVE-2025-21721

Mitre link : CVE-2025-21721

CVE.ORG link : CVE-2025-21721

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-617

Reachable Assertion