GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21699 (GCVE-0-2025-21699)

Vulnerability from cvelistv5 – Published: 2025-02-12 13:52 – Updated: 2026-08-05 11:53
VLAI
Title
gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
Summary
In the Linux kernel, the following vulnerability has been resolved: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag Truncate an inode's address space when flipping the GFS2_DIF_JDATA flag: depending on that flag, the pages in the address space will either use buffer heads or iomap_folio_state structs, and we cannot mix the two.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:51 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2164f9b9186962ffb7c687e18ec6f5255525f09d , < 8c41abc11aa8438c9ed2d973f97e66674c0355df (git)
Affected: 2164f9b9186962ffb7c687e18ec6f5255525f09d , < 4e3ded34f3f3c9d7ed2aac7be8cf51153646574a (git)
Affected: 2164f9b9186962ffb7c687e18ec6f5255525f09d , < 2a40a140e11fec699e128170ccaa98b6b82cb503 (git)
Affected: 2164f9b9186962ffb7c687e18ec6f5255525f09d , < 4dd57d1f0e9844311c635a7fb39abce4f2ac5a61 (git)
Affected: 2164f9b9186962ffb7c687e18ec6f5255525f09d , < 4516febe325342555bb09ca5b396fb816d655821 (git)
Affected: 2164f9b9186962ffb7c687e18ec6f5255525f09d , < 5bb1fd0855bb0abc7d97e44758d6ffed7882d2d0 (git)
Affected: 2164f9b9186962ffb7c687e18ec6f5255525f09d , < 7c9d9223802fbed4dee1ae301661bf346964c9d2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.234 , ≤ 5.10.* (semver)
Unaffected: 5.15.178 , ≤ 5.15.* (semver)
Unaffected: 6.1.128 , ≤ 6.1.* (semver)
Unaffected: 6.6.75 , ≤ 6.6.* (semver)
Unaffected: 6.12.12 , ≤ 6.12.* (semver)
Unaffected: 6.13.1 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:51:04.949443Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:09.197Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:59:23.304Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c41abc11aa8438c9ed2d973f97e66674c0355df",
              "status": "affected",
              "version": "2164f9b9186962ffb7c687e18ec6f5255525f09d",
              "versionType": "git"
            },
            {
              "lessThan": "4e3ded34f3f3c9d7ed2aac7be8cf51153646574a",
              "status": "affected",
              "version": "2164f9b9186962ffb7c687e18ec6f5255525f09d",
              "versionType": "git"
            },
            {
              "lessThan": "2a40a140e11fec699e128170ccaa98b6b82cb503",
              "status": "affected",
              "version": "2164f9b9186962ffb7c687e18ec6f5255525f09d",
              "versionType": "git"
            },
            {
              "lessThan": "4dd57d1f0e9844311c635a7fb39abce4f2ac5a61",
              "status": "affected",
              "version": "2164f9b9186962ffb7c687e18ec6f5255525f09d",
              "versionType": "git"
            },
            {
              "lessThan": "4516febe325342555bb09ca5b396fb816d655821",
              "status": "affected",
              "version": "2164f9b9186962ffb7c687e18ec6f5255525f09d",
              "versionType": "git"
            },
            {
              "lessThan": "5bb1fd0855bb0abc7d97e44758d6ffed7882d2d0",
              "status": "affected",
              "version": "2164f9b9186962ffb7c687e18ec6f5255525f09d",
              "versionType": "git"
            },
            {
              "lessThan": "7c9d9223802fbed4dee1ae301661bf346964c9d2",
              "status": "affected",
              "version": "2164f9b9186962ffb7c687e18ec6f5255525f09d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.234",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.178",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.128",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.75",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.12",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Truncate address space when flipping GFS2_DIF_JDATA flag\n\nTruncate an inode\u0027s address space when flipping the GFS2_DIF_JDATA flag:\ndepending on that flag, the pages in the address space will either use\nbuffer heads or iomap_folio_state structs, and we cannot mix the two."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the local ioctl(FS_IOC_SETFLAGS) syscall path (ioctl_setflags \u2192 vfs_fileattr_set \u2192 gfs2_fileattr_set \u2192 do_gfs2_set_flags) on a file residing on a mounted GFS2 filesystem. No network-facing code path processes attacker data here.\nAC:L - Exploitation is fully deterministic and single-threaded: populate the page cache by writing to a file, flip GFS2_DIF_JDATA with chattr, then touch/truncate/fadvise the file to drive the mismatched aops over the stale folio-\u003eprivate. There is no race to win and no memory-layout precondition outside the attacker\u0027s control.\nPR:L - The only access control on the path is inode_owner_or_capable(), so any unprivileged local user who owns a file on the GFS2 mount can flip the flag; fileattr_set_prepare() restricts only APPEND/IMMUTABLE and project IDs, not FS_JOURNAL_DATA_FL. GFS2 is deployed as admin-mounted shared cluster/HPC storage where ordinary users routinely own files.\nUI:N - The attacker performs every step themselves (create file, write, chattr, re-access) with no action by any other user. The GFS2 filesystem is already mounted as part of normal operation in the target deployment.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard local kernel privilege-escalation scope.\nC:H - The type confusion yields out-of-bounds reads past the ~24-byte iomap_folio_state (b_size/b_data/b_end_io read from adjacent slab objects) and leaks buffer_head pointer contents through ifs-\u003estate bitmap reads, plus a use-after-free on buffer_head that gives the attacker control of freed-object contents and thus an arbitrary-read primitive.\nI:H - ifs_free() calls kfree() on a live buffer_head still linked into the bh ring, bh_lru and b_assoc_buffers lists, producing a UAF with list-unlink write primitives; bitmap_set()/atomic_add() write directly into b_folio/b_blocknr/b_this_page, and in the opposite direction an OOB-read b_data is used as a memcpy destination for user-controlled data while b_end_io is called as a function pointer.\nA:H - spin_lock_irqsave() on ifs-\u003estate_lock aliased onto a non-zero bh-\u003eb_state spins forever with interrupts disabled, causing a hard lockup, and the corrupted b_this_page/b_folio pointers plus the buffer_head UAF reliably produce oopses and panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:41.986Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c41abc11aa8438c9ed2d973f97e66674c0355df"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e3ded34f3f3c9d7ed2aac7be8cf51153646574a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a40a140e11fec699e128170ccaa98b6b82cb503"
        },
        {
          "url": "https://git.kernel.org/stable/c/4dd57d1f0e9844311c635a7fb39abce4f2ac5a61"
        },
        {
          "url": "https://git.kernel.org/stable/c/4516febe325342555bb09ca5b396fb816d655821"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bb1fd0855bb0abc7d97e44758d6ffed7882d2d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c9d9223802fbed4dee1ae301661bf346964c9d2"
        }
      ],
      "title": "gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21699",
    "datePublished": "2025-02-12T13:52:50.962Z",
    "dateReserved": "2024-12-29T08:45:45.748Z",
    "dateUpdated": "2026-08-05T11:53:41.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21699",
      "date": "2026-09-16",
      "epss": "0.00248",
      "percentile": "0.16305"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21699\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-12T14:15:33.020\",\"lastModified\":\"2026-07-30T06:19:28.157\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngfs2: Truncate address space when flipping GFS2_DIF_JDATA flag\\n\\nTruncate an inode\u0027s address space when flipping the GFS2_DIF_JDATA flag:\\ndepending on that flag, the pages in the address space will either use\\nbuffer heads or iomap_folio_state structs, and we cannot mix the two.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gfs2: Trunca el espacio de direcciones al invertir el indicador GFS2_DIF_JDATA Trunca el espacio de direcciones de un inodo al invertir el indicador GFS2_DIF_JDATA: dependiendo de ese indicador, las p\u00e1ginas en el espacio de direcciones usar\u00e1n encabezados de b\u00fafer o estructuras iomap_folio_state, y no podemos mezclar los dos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/gfs2/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2164f9b9186962ffb7c687e18ec6f5255525f09d\",\"lessThan\":\"8c41abc11aa8438c9ed2d973f97e66674c0355df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2164f9b9186962ffb7c687e18ec6f5255525f09d\",\"lessThan\":\"4e3ded34f3f3c9d7ed2aac7be8cf51153646574a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2164f9b9186962ffb7c687e18ec6f5255525f09d\",\"lessThan\":\"2a40a140e11fec699e128170ccaa98b6b82cb503\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2164f9b9186962ffb7c687e18ec6f5255525f09d\",\"lessThan\":\"4dd57d1f0e9844311c635a7fb39abce4f2ac5a61\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2164f9b9186962ffb7c687e18ec6f5255525f09d\",\"lessThan\":\"4516febe325342555bb09ca5b396fb816d655821\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2164f9b9186962ffb7c687e18ec6f5255525f09d\",\"lessThan\":\"5bb1fd0855bb0abc7d97e44758d6ffed7882d2d0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2164f9b9186962ffb7c687e18ec6f5255525f09d\",\"lessThan\":\"7c9d9223802fbed4dee1ae301661bf346964c9d2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/gfs2/file.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.234\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.178\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.128\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.75\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.12\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.1\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:51:04.949443Z\",\"id\":\"CVE-2025-21699\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.290\",\"matchCriteriaId\":\"9B09D658-F9BE-4274-8C4E-8E1D8D14BD19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.234\",\"matchCriteriaId\":\"F732162B-ED7E-4367-A5C2-B24FD9B0D33B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.178\",\"matchCriteriaId\":\"171159A1-9827-4C7B-821D-55398B837C49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.128\",\"matchCriteriaId\":\"EDB5047C-0330-407A-BE1B-513B5BF304DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.75\",\"matchCriteriaId\":\"E8D39B53-7390-48BE-92FD-8846BE8E8430\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.12\",\"matchCriteriaId\":\"B04C243A-753B-49A9-87C7-92FCC1425FB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A3F9505-6B98-4269-8B81-127E55A1BF00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DFCDFB8-4FD0-465A-9076-D813D78FE51B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2a40a140e11fec699e128170ccaa98b6b82cb503\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4516febe325342555bb09ca5b396fb816d655821\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4dd57d1f0e9844311c635a7fb39abce4f2ac5a61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e3ded34f3f3c9d7ed2aac7be8cf51153646574a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5bb1fd0855bb0abc7d97e44758d6ffed7882d2d0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7c9d9223802fbed4dee1ae301661bf346964c9d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c41abc11aa8438c9ed2d973f97e66674c0355df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:41:16+00:00",
      "cve": "CVE-2025-21699",
      "id": "CVE-2025-21699",
      "initial_release_date": "2025-02-12T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21699.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:28:35Z",
      "cve": "CVE-2025-21699",
      "id": "CVE-2025-21699",
      "initial_release_date": "2025-02-13T00:20:35Z",
      "product_status:known_affected": "353",
      "product_status:known_not_affected": "237",
      "product_status:recommended": "679",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21699",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21699.json",
      "version": "55"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:59:23.304Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21699\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:51:04.949443Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:00:39.928Z\"}}], \"cna\": {\"title\": \"gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached through the local ioctl(FS_IOC_SETFLAGS) syscall path (ioctl_setflags \\u2192 vfs_fileattr_set \\u2192 gfs2_fileattr_set \\u2192 do_gfs2_set_flags) on a file residing on a mounted GFS2 filesystem. No network-facing code path processes attacker data here.\\nAC:L - Exploitation is fully deterministic and single-threaded: populate the page cache by writing to a file, flip GFS2_DIF_JDATA with chattr, then touch/truncate/fadvise the file to drive the mismatched aops over the stale folio-\u003eprivate. There is no race to win and no memory-layout precondition outside the attacker\u0027s control.\\nPR:L - The only access control on the path is inode_owner_or_capable(), so any unprivileged local user who owns a file on the GFS2 mount can flip the flag; fileattr_set_prepare() restricts only APPEND/IMMUTABLE and project IDs, not FS_JOURNAL_DATA_FL. GFS2 is deployed as admin-mounted shared cluster/HPC storage where ordinary users routinely own files.\\nUI:N - The attacker performs every step themselves (create file, write, chattr, re-access) with no action by any other user. The GFS2 filesystem is already mounted as part of normal operation in the target deployment.\\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard local kernel privilege-escalation scope.\\nC:H - The type confusion yields out-of-bounds reads past the ~24-byte iomap_folio_state (b_size/b_data/b_end_io read from adjacent slab objects) and leaks buffer_head pointer contents through ifs-\u003estate bitmap reads, plus a use-after-free on buffer_head that gives the attacker control of freed-object contents and thus an arbitrary-read primitive.\\nI:H - ifs_free() calls kfree() on a live buffer_head still linked into the bh ring, bh_lru and b_assoc_buffers lists, producing a UAF with list-unlink write primitives; bitmap_set()/atomic_add() write directly into b_folio/b_blocknr/b_this_page, and in the opposite direction an OOB-read b_data is used as a memcpy destination for user-controlled data while b_end_io is called as a function pointer.\\nA:H - spin_lock_irqsave() on ifs-\u003estate_lock aliased onto a non-zero bh-\u003eb_state spins forever with interrupts disabled, causing a hard lockup, and the corrupted b_this_page/b_folio pointers plus the buffer_head UAF reliably produce oopses and panics.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2164f9b9186962ffb7c687e18ec6f5255525f09d\", \"lessThan\": \"8c41abc11aa8438c9ed2d973f97e66674c0355df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2164f9b9186962ffb7c687e18ec6f5255525f09d\", \"lessThan\": \"4e3ded34f3f3c9d7ed2aac7be8cf51153646574a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2164f9b9186962ffb7c687e18ec6f5255525f09d\", \"lessThan\": \"2a40a140e11fec699e128170ccaa98b6b82cb503\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2164f9b9186962ffb7c687e18ec6f5255525f09d\", \"lessThan\": \"4dd57d1f0e9844311c635a7fb39abce4f2ac5a61\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2164f9b9186962ffb7c687e18ec6f5255525f09d\", \"lessThan\": \"4516febe325342555bb09ca5b396fb816d655821\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2164f9b9186962ffb7c687e18ec6f5255525f09d\", \"lessThan\": \"5bb1fd0855bb0abc7d97e44758d6ffed7882d2d0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2164f9b9186962ffb7c687e18ec6f5255525f09d\", \"lessThan\": \"7c9d9223802fbed4dee1ae301661bf346964c9d2\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/gfs2/file.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.234\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.178\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.128\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.75\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/gfs2/file.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8c41abc11aa8438c9ed2d973f97e66674c0355df\"}, {\"url\": \"https://git.kernel.org/stable/c/4e3ded34f3f3c9d7ed2aac7be8cf51153646574a\"}, {\"url\": \"https://git.kernel.org/stable/c/2a40a140e11fec699e128170ccaa98b6b82cb503\"}, {\"url\": \"https://git.kernel.org/stable/c/4dd57d1f0e9844311c635a7fb39abce4f2ac5a61\"}, {\"url\": \"https://git.kernel.org/stable/c/4516febe325342555bb09ca5b396fb816d655821\"}, {\"url\": \"https://git.kernel.org/stable/c/5bb1fd0855bb0abc7d97e44758d6ffed7882d2d0\"}, {\"url\": \"https://git.kernel.org/stable/c/7c9d9223802fbed4dee1ae301661bf346964c9d2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngfs2: Truncate address space when flipping GFS2_DIF_JDATA flag\\n\\nTruncate an inode\u0027s address space when flipping the GFS2_DIF_JDATA flag:\\ndepending on that flag, the pages in the address space will either use\\nbuffer heads or iomap_folio_state structs, and we cannot mix the two.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.234\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.178\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.128\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.75\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.12\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.1\", \"versionStartIncluding\": \"5.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"5.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:53:41.986Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21699\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:53:41.986Z\", \"dateReserved\": \"2024-12-29T08:45:45.748Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-12T13:52:50.962Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.