In the Linux kernel, the following vulnerability has been resolved:
ovl: fix UAF in ovldentryupdatereval by moving dput() in ovllink_up
The issue was caused by dput(upper) being called before ovldentryupdatereval(), while upper->dflags was still accessed in ovldentryremote().
Move dput(upper) after its last use to prevent use-after-free.
BUG: KASAN: slab-use-after-free in ovldentryremote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovldentryupdate_reval+0xd2/0xf0 fs/overlayfs/util.c:167
Call Trace: <TASK> _dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x116/0x1f0 lib/dumpstack.c:114 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0xc3/0x620 mm/kasan/report.c:488 kasanreport+0xd9/0x110 mm/kasan/report.c:601 ovldentryremote fs/overlayfs/util.c:162 [inline] ovldentryupdatereval+0xd2/0xf0 fs/overlayfs/util.c:167 ovllinkup fs/overlayfs/copyup.c:610 [inline] ovlcopyupone+0x2105/0x3490 fs/overlayfs/copyup.c:1170 ovlcopyupflags+0x18d/0x200 fs/overlayfs/copyup.c:1223 ovlrename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfsrename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK>
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"292731348702452104302272458869070383562",
"177048110155681231082604822440756036462",
"105195712930698427633433584187267321305",
"229808364133572075337060234642872867269",
"319205326860271153072868203131688671150",
"297657735494098151337462530795815877270",
"166231103833100460466488903170946163489",
"186163900198848234758144910706984949251"
]
},
"target": {
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3594aad97e7be2557ca9fa9c931b206b604028c8",
"signature_version": "v1",
"id": "CVE-2025-21887-2d93b442"
},
{
"digest": {
"length": 816.0,
"function_hash": "312786781757420563218920807404346812374"
},
"target": {
"function": "ovl_link_up",
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b49d939b5a79117f939b77cc67efae2694d9799",
"signature_version": "v1",
"id": "CVE-2025-21887-30be886c"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"292731348702452104302272458869070383562",
"177048110155681231082604822440756036462",
"105195712930698427633433584187267321305",
"229808364133572075337060234642872867269",
"319205326860271153072868203131688671150",
"297657735494098151337462530795815877270",
"166231103833100460466488903170946163489",
"186163900198848234758144910706984949251"
]
},
"target": {
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60b4b5c1277fc491da9e1e7abab307bfa39c2db7",
"signature_version": "v1",
"id": "CVE-2025-21887-44ac3f93"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"292731348702452104302272458869070383562",
"177048110155681231082604822440756036462",
"105195712930698427633433584187267321305",
"229808364133572075337060234642872867269",
"319205326860271153072868203131688671150",
"297657735494098151337462530795815877270",
"166231103833100460466488903170946163489",
"186163900198848234758144910706984949251"
]
},
"target": {
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64455c8051c3aedc71abb7ec8d47c80301f99f00",
"signature_version": "v1",
"id": "CVE-2025-21887-46c4e119"
},
{
"digest": {
"length": 890.0,
"function_hash": "263414428117799052194615596526248626536"
},
"target": {
"function": "ovl_link_up",
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c84e125fff2615b4d9c259e762596134eddd2f27",
"signature_version": "v1",
"id": "CVE-2025-21887-4aa496b4"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"292731348702452104302272458869070383562",
"177048110155681231082604822440756036462",
"118544245101681260784538207367961604536",
"132725105099991411800228659580940688858",
"227840105326263183296570800621772520011",
"297657735494098151337462530795815877270",
"166231103833100460466488903170946163489",
"186163900198848234758144910706984949251"
]
},
"target": {
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b49d939b5a79117f939b77cc67efae2694d9799",
"signature_version": "v1",
"id": "CVE-2025-21887-a6647da5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"292731348702452104302272458869070383562",
"177048110155681231082604822440756036462",
"105195712930698427633433584187267321305",
"229808364133572075337060234642872867269",
"319205326860271153072868203131688671150",
"297657735494098151337462530795815877270",
"166231103833100460466488903170946163489",
"186163900198848234758144910706984949251"
]
},
"target": {
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c84e125fff2615b4d9c259e762596134eddd2f27",
"signature_version": "v1",
"id": "CVE-2025-21887-afecc433"
},
{
"digest": {
"length": 828.0,
"function_hash": "259301314922511701540783438689682139292"
},
"target": {
"function": "ovl_link_up",
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64455c8051c3aedc71abb7ec8d47c80301f99f00",
"signature_version": "v1",
"id": "CVE-2025-21887-cfb968d1"
},
{
"digest": {
"length": 890.0,
"function_hash": "263414428117799052194615596526248626536"
},
"target": {
"function": "ovl_link_up",
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3594aad97e7be2557ca9fa9c931b206b604028c8",
"signature_version": "v1",
"id": "CVE-2025-21887-db29f428"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"292731348702452104302272458869070383562",
"177048110155681231082604822440756036462",
"105195712930698427633433584187267321305",
"229808364133572075337060234642872867269",
"319205326860271153072868203131688671150",
"297657735494098151337462530795815877270",
"166231103833100460466488903170946163489",
"186163900198848234758144910706984949251"
]
},
"target": {
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7c41830ffcd17b2177a95a9b99b270302090c35",
"signature_version": "v1",
"id": "CVE-2025-21887-e477f2d0"
},
{
"digest": {
"length": 890.0,
"function_hash": "263414428117799052194615596526248626536"
},
"target": {
"function": "ovl_link_up",
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60b4b5c1277fc491da9e1e7abab307bfa39c2db7",
"signature_version": "v1",
"id": "CVE-2025-21887-e6eadf33"
},
{
"digest": {
"length": 828.0,
"function_hash": "259301314922511701540783438689682139292"
},
"target": {
"function": "ovl_link_up",
"file": "fs/overlayfs/copy_up.c"
},
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7c41830ffcd17b2177a95a9b99b270302090c35",
"signature_version": "v1",
"id": "CVE-2025-21887-f66cd69a"
}
]