CVE-2025-21887

HighCVSS 7.8/10Last modified Nov 10, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up

The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote().

Move dput(upper) after its last use to prevent use-after-free.

BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167

Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [inline] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [inline] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK>

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 714ba10a6dd19752a349e59aa875f3288ccb59b9, < f77618291836168eca99e89cd175256f928f5e64; >= 62f29ca45f832e281fc14966ac25f6ff3bd121ca, < 4b49d939b5a79117f939b77cc67efae2694d9799; >= e4f2a1feebb3f209a0fca82aa53507a5b8be4d53, < a7c41830ffcd17b2177a95a9b99b270302090c35; >= b07d5cc93e1b28df47a72c519d09d0a836043613, < 64455c8051c3aedc71abb7ec8d47c80301f99f00; >= b07d5cc93e1b28df47a72c519d09d0a836043613, < 3594aad97e7be2557ca9fa9c931b206b604028c8; >= b07d5cc93e1b28df47a72c519d09d0a836043613, < 60b4b5c1277fc491da9e1e7abab307bfa39c2db7; >= b07d5cc93e1b28df47a72c519d09d0a836043613, < c84e125fff2615b4d9c259e762596134eddd2f27; 33ab4dd6202f359558a0a2678b94d1b9994c17e5; 1ecdc55e5cd9f70f8d7513802971d4cffb9f77af; >= 5.10.188, < 5.10.247; >= 5.15.121, < 5.15.179; >= 6.1.39, < 6.1.130; >= 6.3.13, < 6.4; >= 6.4.4, < 6.5
LinuxLinux6.5
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)>= V3.1.7, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)>= V3.1.6, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)>= V3.1.7, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)>= V3.1.6, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)>= V3.1.7, < *

References

Timeline

Published
Mar 27, 2025
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-218885.5In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix a WARN during dereg_mr for DM type Memory regions (MR) CVE-2025-218895.5In the Linux kernel, the following vulnerability has been resolved: perf/core: Add RCU read lock protection to perf_iterate_ctx() The perfCVE-2025-21895.1This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker withCVE-2025-218905.5In the Linux kernel, the following vulnerability has been resolved: idpf: fix checksums set in idpf_rx_rsc() idpf_rx_rsc() uses skb_transpCVE-2025-218915.5In the Linux kernel, the following vulnerability has been resolved: ipvlan: ensure network headers are in skb linear part syzbot found thaCVE-2025-218924.7In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix the recovery flow of the UMR QP This patch addresses anCVE-2025-218937.8In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in key_put() Once a key's reference count has been reducCVE-2025-218945.5In the Linux kernel, the following vulnerability has been resolved: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC Actually ENETCCVE-2025-218954.7In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_liCVE-2025-218967.8In the Linux kernel, the following vulnerability has been resolved: fuse: revert back to __readahead_folio() for readahead In commit 3eab9CVE-2025-218975.5In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix pick_task_scx() picking non-queued tasks when it's calleCVE-2025-218985.5In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in function_stat_show() Check
CVE-2025-21887: High severity, CVSS 7.8 | Vulnix