| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\n\nThe issue was caused by dput(upper) being called before\novl_dentry_update_reval(), while upper->d_flags was still\naccessed in ovl_dentry_remote().\n\nMove dput(upper) after its last use to prevent use-after-free.\n\nBUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\nBUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:488\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\n ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\n ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n ovl_link_up fs/overlayfs/copy_up.c:610 [inline]\n ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170\n ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223\n ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136\n vfs_rename+0xf84/0x20a0 fs/namei.c:4893\n...\n </TASK>" |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "fs/overlayfs/copy_up.c" |
| ], |
| "versions": [ |
| { |
| "version": "62f29ca45f832e281fc14966ac25f6ff3bd121ca", |
| "lessThan": "4b49d939b5a79117f939b77cc67efae2694d9799", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "e4f2a1feebb3f209a0fca82aa53507a5b8be4d53", |
| "lessThan": "a7c41830ffcd17b2177a95a9b99b270302090c35", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b07d5cc93e1b28df47a72c519d09d0a836043613", |
| "lessThan": "64455c8051c3aedc71abb7ec8d47c80301f99f00", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b07d5cc93e1b28df47a72c519d09d0a836043613", |
| "lessThan": "3594aad97e7be2557ca9fa9c931b206b604028c8", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b07d5cc93e1b28df47a72c519d09d0a836043613", |
| "lessThan": "60b4b5c1277fc491da9e1e7abab307bfa39c2db7", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b07d5cc93e1b28df47a72c519d09d0a836043613", |
| "lessThan": "c84e125fff2615b4d9c259e762596134eddd2f27", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "714ba10a6dd19752a349e59aa875f3288ccb59b9", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "33ab4dd6202f359558a0a2678b94d1b9994c17e5", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "1ecdc55e5cd9f70f8d7513802971d4cffb9f77af", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "fs/overlayfs/copy_up.c" |
| ], |
| "versions": [ |
| { |
| "version": "6.5", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "6.5", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.179", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.130", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.81", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.12.18", |
| "lessThanOrEqual": "6.12.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.13.6", |
| "lessThanOrEqual": "6.13.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.14", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.15.121", |
| "versionEndExcluding": "5.15.179" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "6.1.39", |
| "versionEndExcluding": "6.1.130" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "6.5", |
| "versionEndExcluding": "6.6.81" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "6.5", |
| "versionEndExcluding": "6.12.18" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "6.5", |
| "versionEndExcluding": "6.13.6" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "6.5", |
| "versionEndExcluding": "6.14" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.10.188" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "6.3.13" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "6.4.4" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27" |
| } |
| ], |
| "title": "ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2025-21887", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
