CVE-2025-21887

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-21887
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21887.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21887
Downstream
Related
Published
2025-03-27T14:57:14.524Z
Modified
2026-03-11T07:51:49.319359Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
Details

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix UAF in ovldentryupdatereval by moving dput() in ovllink_up

The issue was caused by dput(upper) being called before ovldentryupdatereval(), while upper->dflags was still accessed in ovldentryremote().

Move dput(upper) after its last use to prevent use-after-free.

BUG: KASAN: slab-use-after-free in ovldentryremote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovldentryupdate_reval+0xd2/0xf0 fs/overlayfs/util.c:167

Call Trace: <TASK> _dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x116/0x1f0 lib/dumpstack.c:114 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0xc3/0x620 mm/kasan/report.c:488 kasanreport+0xd9/0x110 mm/kasan/report.c:601 ovldentryremote fs/overlayfs/util.c:162 [inline] ovldentryupdatereval+0xd2/0xf0 fs/overlayfs/util.c:167 ovllinkup fs/overlayfs/copyup.c:610 [inline] ovlcopyupone+0x2105/0x3490 fs/overlayfs/copyup.c:1170 ovlcopyupflags+0x18d/0x200 fs/overlayfs/copyup.c:1223 ovlrename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfsrename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK>

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21887.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
714ba10a6dd19752a349e59aa875f3288ccb59b9
Fixed
f77618291836168eca99e89cd175256f928f5e64
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
62f29ca45f832e281fc14966ac25f6ff3bd121ca
Fixed
4b49d939b5a79117f939b77cc67efae2694d9799
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e4f2a1feebb3f209a0fca82aa53507a5b8be4d53
Fixed
a7c41830ffcd17b2177a95a9b99b270302090c35
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b07d5cc93e1b28df47a72c519d09d0a836043613
Fixed
64455c8051c3aedc71abb7ec8d47c80301f99f00
Fixed
3594aad97e7be2557ca9fa9c931b206b604028c8
Fixed
60b4b5c1277fc491da9e1e7abab307bfa39c2db7
Fixed
c84e125fff2615b4d9c259e762596134eddd2f27
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
33ab4dd6202f359558a0a2678b94d1b9994c17e5
Last affected
1ecdc55e5cd9f70f8d7513802971d4cffb9f77af

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21887.json"