CVE-2025-21887

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21887
In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote(). Move dput(upper) after its last use to prevent use-after-free. BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [inline] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [inline] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK>

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8 Patch
https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799 Patch
https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7 Patch
https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00 Patch
https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35 Patch
https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27 Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
History

03 Nov 2025, 20:17

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html -

01 Apr 2025, 15:45

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8 - () https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8 - Patch
References () https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799 - () https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799 - Patch
References () https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7 - () https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7 - Patch
References () https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00 - () https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00 - Patch
References () https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35 - () https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35 - Patch
References () https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27 - () https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ovl: Se corrige el UAF en ovl_dentry_update_reval moviendo dput() en ovl_link_up. El problema se debía a que dput(upper) se llamaba antes de ovl_dentry_update_reval(), mientras que se seguía accediendo a upper-&gt;d_flags en ovl_dentry_remote(). Se mueve dput(upper) después de su último uso para evitar el use-after-free. ERROR: KASAN: slab-use-after-free en ovl_dentry_remote fs/overlayfs/util.c:162 [en línea] ERROR: KASAN: slab-use-after-free en ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 Rastreo de llamadas: __dump_stack lib/dump_stack.c:88 [en línea] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [en línea] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [en línea] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [en línea] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ...

27 Mar 2025, 18:17

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

27 Mar 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 15:15

Updated : 2025-11-03 20:17

NVD link : CVE-2025-21887

Mitre link : CVE-2025-21887

CVE.ORG link : CVE-2025-21887

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free