CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
In the Linux kernel, the following vulnerability has been resolved:
ovl: fix UAF in ovldentryupdatereval by moving dput() in ovllinkup
The issue was caused by dput(upper) being called before ovldentryupdatereval(), while upper->dflags was still accessed in ovldentryremote().
Move dput(upper) after its last use to prevent use-after-free.
BUG: KASAN: slab-use-after-free in ovldentryremote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovldentryupdatereval+0xd2/0xf0 fs/overlayfs/util.c:167
Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x116/0x1f0 lib/dumpstack.c:114 printaddressdescription mm/kasan/report.c:377 [inline] printreport+0xc3/0x620 mm/kasan/report.c:488 kasanreport+0xd9/0x110 mm/kasan/report.c:601 ovldentryremote fs/overlayfs/util.c:162 [inline] ovldentryupdatereval+0xd2/0xf0 fs/overlayfs/util.c:167 ovllinkup fs/overlayfs/copyup.c:610 [inline] ovlcopyupone+0x2105/0x3490 fs/overlayfs/copyup.c:1170 ovlcopyupflags+0x18d/0x200 fs/overlayfs/copyup.c:1223 ovlrename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfsrename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.82.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.180.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21887?
CVE-2025-21887 has been rated with a medium severity level due to the potential for user-after-free vulnerabilities.
How do I fix CVE-2025-21887?
To fix CVE-2025-21887, update your Linux kernel to the latest version where the vulnerability has been patched.
Which systems are affected by CVE-2025-21887?
CVE-2025-21887 affects the Linux kernel, specifically the components dealing with overlay filesystems.
What are the potential consequences of CVE-2025-21887?
The potential consequences of CVE-2025-21887 include denial of service and exploitation through crafted filesystem operations.
When was CVE-2025-21887 disclosed?
CVE-2025-21887 was disclosed in early 2025 as part of the ongoing security assessment of the Linux kernel.