|
Vulnerabilities
< Back

CVE-2025-21887

Updated on 27 Mar 2025

Severity

7.1 High severity

Details

CVSS score
7.1
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up

The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote().

Move dput(upper) after its last use to prevent use-after-free.

BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167

Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [inline] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [inline] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 … </TASK>

Details

Affected product:
AlmaLinux 9.2 ESU , TuxCare 9.6 ESU
Affected packages:
kernel @ 5.14.0 (+1 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 9 Released
40 kernels
  • 5.14.0-427.13.1.el9_4
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-503.11.1.el9_5
  • 5.14.0-503.14.1.el9_5
  • 5.14.0-503.15.1.el9_5
  • 5.14.0-503.16.1.el9_5
  • 5.14.0-503.19.1.el9_5
  • 5.14.0-503.21.1.el9_5
  • 5.14.0-503.22.1.el9_5
  • 5.14.0-503.23.2.el9_5
  • 5.14.0-503.26.1.el9_5
  • 5.14.0-503.23.1.el9_5
  • 5.14.0-503.31.1.el9_5
  • 5.14.0-503.34.1.el9_5
  • 5.14.0-503.29.1.el9_5
  • 5.14.0-503.35.1.el9_5
  • 5.14.0-503.33.1.el9_5
  • 5.14.0-503.38.1.el9_5
  • 5.14.0-503.40.1.el9_5
  • 5.14.0-570.12.1.el9_6
  • 5.14.0-570.16.1.el9_6
  • 5.14.0-570.17.1.el9_6
  • 5.14.0-570.18.1.el9_6
  • 5.14.0-570.19.1.el9_6
  • 5.14.0-570.21.1.el9_6
  • 5.14.0-570.22.1.el9_6
  • 5.14.0-570.23.1.el9_6
  • 5.14.0-570.24.1.el9_6
AlmaLinux 9.2 ESU Ready For Release —
Amazon Linux 2023 Planned —
Debian 11 Released
13 kernels
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.205-2
  • 5.10.205-1
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
Debian 11 cloud Released
12 kernels
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.205-2
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
Debian 12 Released
23 kernels
  • 6.1.38-1
  • 6.1.38-2
  • 6.1.38-4
  • 6.1.52-1
  • 6.1.55-1
  • 6.1.64-1
  • 6.1.66-1
  • 6.1.69-1
  • 6.1.76-1
  • 6.1.27-1
  • 6.1.67-1
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
Oracle Linux 9 Released
40 kernels
  • 5.14.0-427.13.1.el9_4
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-503.11.1.el9_5
  • 5.14.0-503.14.1.el9_5
  • 5.14.0-503.15.1.el9_5
  • 5.14.0-503.16.1.el9_5
  • 5.14.0-503.19.1.el9_5
  • 5.14.0-503.21.1.el9_5
  • 5.14.0-503.22.1.el9_5
  • 5.14.0-503.23.1.el9_5
  • 5.14.0-503.23.2.el9_5
  • 5.14.0-503.26.1.el9_5
  • 5.14.0-503.31.1.el9_5
  • 5.14.0-503.29.1.el9_5
  • 5.14.0-503.33.1.el9_5
  • 5.14.0-503.34.1.el9_5
  • 5.14.0-503.35.1.el9_5
  • 5.14.0-503.38.1.el9_5
  • 5.14.0-503.40.1.el9_5
  • 5.14.0-570.12.1.0.1.el9_6
  • 5.14.0-570.16.1.0.1.el9_6
  • 5.14.0-570.17.1.0.1.el9_6
  • 5.14.0-570.18.1.0.1.el9_6
  • 5.14.0-570.19.1.0.1.el9_6
  • 5.14.0-570.21.1.0.1.el9_6
  • 5.14.0-570.22.1.0.1.el9_6
  • 5.14.0-570.23.1.0.1.el9_6
  • 5.14.0-570.24.1.0.1.el9_6
Proxmox VE 7 5.15 Released
10 kernels
  • 5.15.126-1-pve-5.15.126-1
  • 5.15.131-1-pve-5.15.131-1
  • 5.15.131-1-pve-5.15.131-2
  • 5.15.131-2-pve-5.15.131-3
  • 5.15.136-1-pve-5.15.136-1
  • 5.15.143-1-pve-5.15.143-1
  • 5.15.149-1-pve-5.15.149-1
  • 5.15.152-1-pve-5.15.152-1
  • 5.15.158-1-pve_5.15.158-1
  • 5.15.158-2-pve_5.15.158-2
RHEL 10 Will Not Fix —
RHEL 9 Released
40 kernels
  • 5.14.0-427.13.1.el9_4
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-503.11.1.el9_5
  • 5.14.0-503.14.1.el9_5
  • 5.14.0-503.15.1.el9_5
  • 5.14.0-503.19.1.el9_5
  • 5.14.0-503.21.1.el9_5
  • 5.14.0-503.22.1.el9_5
  • 5.14.0-503.23.1.el9_5
  • 5.14.0-503.23.2.el9_5
  • 5.14.0-503.26.1.el9_5
  • 5.14.0-503.29.1.el9_5
  • 5.14.0-503.31.1.el9_5
  • 5.14.0-503.33.1.el9_5
  • 5.14.0-503.34.1.el9_5
  • 5.14.0-503.35.1.el9_5
  • 5.14.0-503.38.1.el9_5
  • 5.14.0-570.16.1.el9_6
  • 5.14.0-570.17.1.el9_6
  • 5.14.0-570.18.1.el9_6
  • 5.14.0-570.19.1.el9_6
  • 5.14.0-570.21.1.el9_6
  • 5.14.0-570.22.1.el9_6
  • 5.14.0-570.23.1.el9_6
  • 5.14.0-570.24.1.el9_6
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-503.16.1.el9_5
  • 5.14.0-503.40.1.el9_5
  • 5.14.0-570.12.1.el9_6
Rocky Linux 9 Released
36 kernels
  • 5.14.0-427.16.1.el9_4
  • 5.14.0-427.18.1.el9_4
  • 5.14.0-427.20.1.el9_4
  • 5.14.0-427.24.1.el9_4
  • 5.14.0-427.26.1.el9_4
  • 5.14.0-427.28.1.el9_4
  • 5.14.0-427.20.1.el9_4.0.1
  • 5.14.0-427.22.1.el9_4
  • 5.14.0-427.31.1.el9_4
  • 5.14.0-427.33.1.el9_4
  • 5.14.0-427.35.1.el9_4
  • 5.14.0-427.37.1.el9_4
  • 5.14.0-427.40.1.el9_4
  • 5.14.0-427.42.1.el9_4
  • 5.14.0-503.14.1.el9_5
  • 5.14.0-503.15.1.el9_5
  • 5.14.0-503.16.1.el9_5
  • 5.14.0-503.19.1.el9_5
  • 5.14.0-503.21.1.el9_5
  • 5.14.0-503.22.1.el9_5
  • 5.14.0-503.23.2.el9_5
  • 5.14.0-503.26.1.el9_5
  • 5.14.0-503.23.1.el9_5
  • 5.14.0-503.31.1.el9_5
  • 5.14.0-503.34.1.el9_5
  • 5.14.0-503.29.1.el9_5
  • 5.14.0-503.35.1.el9_5
  • 5.14.0-503.33.1.el9_5
  • 5.14.0-503.38.1.el9_5
  • 5.14.0-503.40.1.el9_5
  • 5.14.0-570.18.1.el9_6
  • 5.14.0-570.19.1.el9_6
  • 5.14.0-570.21.1.el9_6
  • 5.14.0-570.22.1.el9_6
  • 5.14.0-570.23.1.el9_6
  • 5.14.0-427.13.1.el9_4
Ubuntu 20.04 HWE AWS Released
30 kernels
  • 5.15.0-1047.52~20.04.1
  • 5.15.0-1048.53~20.04.1
  • 5.15.0-1049.54~20.04.1
  • 5.15.0-1050.55~20.04.1
  • 5.15.0-1051.56~20.04.1
  • 5.15.0-1052.57~20.04.1
  • 5.15.0-1053.58~20.04.1
  • 5.15.0-1055.60~20.04.1
  • 5.15.0-1056.61~20.04.1
  • 5.15.0-1057.63~20.04.1
  • 5.15.0-1058.64~20.04.1
  • 5.15.0-1061.67~20.04.1
  • 5.15.0-1062.68~20.04.1
  • 5.15.0-1063.69~20.04.1
  • 5.15.0-1064.70~20.04.1
  • 5.15.0-1065.71~20.04.1
  • 5.15.0-1066.72~20.04.1
  • 5.15.0-1067.73~20.04.1
  • 5.15.0-1068.74~20.04.1
  • 5.15.0-1069.75~20.04.1
  • 5.15.0-1070.76~20.04.1
  • 5.15.0-1071.77~20.04.1
  • 5.15.0-1072.78~20.04.1
  • 5.15.0-1073.79~20.04.1
  • 5.15.0-1075.82~20.04.1
  • 5.15.0-1077.84~20.04.1
  • 5.15.0-1080.87~20.04.1
  • 5.15.0-1081.88~20.04.1
  • 5.15.0-1082.89~20.04.1
  • 5.15.0-1083.90~20.04.1
Ubuntu 20.04 HWE Azure Released
27 kernels
  • 5.15.0-1049.56~20.04.1
  • 5.15.0-1050.57~20.04.1
  • 5.15.0-1054.62~20.04.1
  • 5.15.0-1056.64~20.04.1
  • 5.15.0-1057.65~20.04.1
  • 5.15.0-1058.66~20.04.2
  • 5.15.0-1059.67~20.04.1
  • 5.15.0-1060.69~20.04.1
  • 5.15.0-1061.70~20.04.1
  • 5.15.0-1063.72~20.04.1
  • 5.15.0-1064.73~20.04.1
  • 5.15.0-1067.76~20.04.1
  • 5.15.0-1068.77~20.04.1
  • 5.15.0-1065.74~20.04.1
  • 5.15.0-1070.79~20.04.1
  • 5.15.0-1071.80~20.04.1
  • 5.15.0-1072.81~20.04.1
  • 5.15.0-1073.82~20.04.1
  • 5.15.0-1074.83~20.04.1
  • 5.15.0-1075.84~20.04.1
  • 5.15.0-1078.87~20.04.1
  • 5.15.0-1079.88~20.04.1
  • 5.15.0-1081.90~20.04.1
  • 5.15.0-1082.91~20.04.1
  • 5.15.0-1086.95~20.04.1
  • 5.15.0-1087.96~20.04.1
  • 5.15.0-1088.97~20.04.1
Ubuntu 22.04 Released
35 kernels
  • 5.15.0-86.96
  • 5.15.0-87.97
  • 5.15.0-88.98
  • 5.15.0-89.99
  • 5.15.0-91.101
  • 5.15.0-92.102
  • 5.15.0-94.104
  • 5.15.0-97.107
  • 5.15.0-100.110
  • 5.15.0-101.111
  • 5.15.0-102.112
  • 5.15.0-105.115
  • 5.15.0-106.116
  • 5.15.0-107.117
  • 5.15.0-112.122
  • 5.15.0-113.123
  • 5.15.0-116.126
  • 5.15.0-117.127
  • 5.15.0-118.128
  • 5.15.0-119.129
  • 5.15.0-121.131
  • 5.15.0-122.132
  • 5.15.0-124.134
  • 5.15.0-125.135
  • 5.15.0-127.137
  • 5.15.0-130.140
  • 5.15.0-126.136
  • 5.15.0-131.141
  • 5.15.0-128.138
  • 5.15.0-133.144
  • 5.15.0-134.145
  • 5.15.0-135.146
  • 5.15.0-136.147
  • 5.15.0-138.148
  • 5.15.0-139.149
Ubuntu 22.04 AWS Released
31 kernels
  • 5.15.0-1047.52
  • 5.15.0-1048.53
  • 5.15.0-1049.54
  • 5.15.0-1050.55
  • 5.15.0-1051.56
  • 5.15.0-1052.57
  • 5.15.0-1053.58
  • 5.15.0-1055.60
  • 5.15.0-1056.61
  • 5.15.0-1057.63
  • 5.15.0-1060.66
  • 5.15.0-1061.67
  • 5.15.0-1062.68
  • 5.15.0-1063.69
  • 5.15.0-1064.70
  • 5.15.0-1065.71
  • 5.15.0-1066.72
  • 5.15.0-1067.73
  • 5.15.0-1068.74
  • 5.15.0-1069.75
  • 5.15.0-1070.76
  • 5.15.0-1071.77
  • 5.15.0-1072.78
  • 5.15.0-1073.79
  • 5.15.0-1076.83
  • 5.15.0-1078.85
  • 5.15.0-1079.86
  • 5.15.0-1080.87
  • 5.15.0-1081.88
  • 5.15.0-1082.89
  • 5.15.0-1083.90
Ubuntu 22.04 Azure Released
31 kernels
  • 5.15.0-1049.56
  • 5.15.0-1050.57
  • 5.15.0-1051.59
  • 5.15.0-1052.60
  • 5.15.0-1053.61
  • 5.15.0-1054.62
  • 5.15.0-1056.64
  • 5.15.0-1057.65
  • 5.15.0-1058.66
  • 5.15.0-1059.67
  • 5.15.0-1060.69
  • 5.15.0-1061.70
  • 5.15.0-1063.72
  • 5.15.0-1064.73
  • 5.15.0-1066.75
  • 5.15.0-1067.76
  • 5.15.0-1068.77
  • 5.15.0-1070.79
  • 5.15.0-1071.80
  • 5.15.0-1072.81
  • 5.15.0-1073.82
  • 5.15.0-1074.83
  • 5.15.0-1075.84
  • 5.15.0-1078.87
  • 5.15.0-1079.88
  • 5.15.0-1081.90
  • 5.15.0-1082.91
  • 5.15.0-1084.93
  • 5.15.0-1086.95
  • 5.15.0-1087.96
  • 5.15.0-1088.97
Ubuntu 24.04 Released
28 kernels
  • 6.8.0-35.35
  • 6.8.0-38.38
  • 6.8.0-36.36
  • 6.8.0-39.39
  • 6.8.0-40.40
  • 6.8.0-41.41
  • 6.8.0-44.44
  • 6.8.0-45.45
  • 6.8.0-31.31
  • 6.8.0-47.47
  • 6.8.0-48.48
  • 6.8.0-49.49
  • 6.8.0-50.51
  • 6.8.0-51.52
  • 6.8.0-52.53
  • 6.8.0-54.56
  • 6.8.0-55.57
  • 6.8.0-53.55
  • 6.8.0-56.58
  • 6.8.0-57.59
  • 6.8.0-58.60
  • 6.8.0-59.61
  • 6.8.0-60.63
  • 6.8.0-62.65
  • 6.8.0-63.66
  • 6.8.0-64.67
  • 6.8.0-71.71
  • 6.8.0-78.78
Ubuntu 24.04 AWS Ready For Release —