CVE-2025-21654: ovl: support encoding fid from inode with no alias
In the Linux kernel, the following vulnerability has been resolved:
ovl: support encoding fid from inode with no alias
Dmitry Safonov reported that a WARNON() assertion can be trigered by userspace when calling inotifyshowfdinfo() for an overlayfs watched inode, whose dentry aliases were discarded with dropcaches.
The WARNON() assertion in inotifyshowfdinfo() was removed, because it is possible for encoding file handle to fail for other reason, but the impact of failing to encode an overlayfs file handle goes beyond this assertion.
As shown in the LTP test case mentioned in the link below, failure to encode an overlayfs file handle from a non-aliased inode also leads to failure to report an fid with FANDELETESELF fanotify events.
As Dmitry notes in his analyzis of the problem, ovlencodefh() fails if it cannot find an alias for the inode, but this failure can be fixed. ovlencodefh() seldom uses the alias and in the case of non-decodable file handles, as is often the case with fanotify fid info, ovlencodefh() never needs to use the alias to encode a file handle.
Defer finding an alias until it is actually needed so ovlencodefh() will not fail in the common case of FANDELETESELF fanotify events.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21654?
CVE-2025-21654 is considered a moderate severity vulnerability due to the potential for user-level exploitation.
How do I fix CVE-2025-21654?
To fix CVE-2025-21654, upgrade to the latest stable release of the Linux kernel that includes the patch.
What systems are affected by CVE-2025-21654?
CVE-2025-21654 affects various versions of the Linux kernel that utilize the overlay filesystem.
Can CVE-2025-21654 be exploited remotely?
CVE-2025-21654 is not typically exploitable remotely as it requires local access to the affected system.
What does the warning in CVE-2025-21654 indicate?
The warning in CVE-2025-21654 indicates that an assertion in the kernel was triggered, potentially leading to instability or unexpected behavior.