CVE-2025-21887 (GCVE-0-2025-21887)

Vulnerability from cvelistv5 – Published: 2025-03-27 14:57 – Updated: 2026-08-05 11:55
VLAI
Title
ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
Summary
In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote(). Move dput(upper) after its last use to prevent use-after-free. BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [inline] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [inline] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK>
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 714ba10a6dd19752a349e59aa875f3288ccb59b9 , < f77618291836168eca99e89cd175256f928f5e64 (git)
Affected: 62f29ca45f832e281fc14966ac25f6ff3bd121ca , < 4b49d939b5a79117f939b77cc67efae2694d9799 (git)
Affected: e4f2a1feebb3f209a0fca82aa53507a5b8be4d53 , < a7c41830ffcd17b2177a95a9b99b270302090c35 (git)
Affected: b07d5cc93e1b28df47a72c519d09d0a836043613 , < 64455c8051c3aedc71abb7ec8d47c80301f99f00 (git)
Affected: b07d5cc93e1b28df47a72c519d09d0a836043613 , < 3594aad97e7be2557ca9fa9c931b206b604028c8 (git)
Affected: b07d5cc93e1b28df47a72c519d09d0a836043613 , < 60b4b5c1277fc491da9e1e7abab307bfa39c2db7 (git)
Affected: b07d5cc93e1b28df47a72c519d09d0a836043613 , < c84e125fff2615b4d9c259e762596134eddd2f27 (git)
Affected: 33ab4dd6202f359558a0a2678b94d1b9994c17e5 (git)
Affected: 1ecdc55e5cd9f70f8d7513802971d4cffb9f77af (git)
Affected: 5.10.188 , < 5.10.247 (semver)
Affected: 5.15.121 , < 5.15.179 (semver)
Affected: 6.1.39 , < 6.1.130 (semver)
Affected: 6.3.13 , < 6.4 (semver)
Affected: 6.4.4 , < 6.5 (semver)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 5.10.247 , ≤ 5.10.* (semver)
Unaffected: 5.15.179 , ≤ 5.15.* (semver)
Unaffected: 6.1.130 , ≤ 6.1.* (semver)
Unaffected: 6.6.81 , ≤ 6.6.* (semver)
Unaffected: 6.12.18 , ≤ 6.12.* (semver)
Unaffected: 6.13.6 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21887",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-27T16:59:58.510815Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T17:08:22.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:38:40.259Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:40:26.912Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/overlayfs/copy_up.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f77618291836168eca99e89cd175256f928f5e64",
              "status": "affected",
              "version": "714ba10a6dd19752a349e59aa875f3288ccb59b9",
              "versionType": "git"
            },
            {
              "lessThan": "4b49d939b5a79117f939b77cc67efae2694d9799",
              "status": "affected",
              "version": "62f29ca45f832e281fc14966ac25f6ff3bd121ca",
              "versionType": "git"
            },
            {
              "lessThan": "a7c41830ffcd17b2177a95a9b99b270302090c35",
              "status": "affected",
              "version": "e4f2a1feebb3f209a0fca82aa53507a5b8be4d53",
              "versionType": "git"
            },
            {
              "lessThan": "64455c8051c3aedc71abb7ec8d47c80301f99f00",
              "status": "affected",
              "version": "b07d5cc93e1b28df47a72c519d09d0a836043613",
              "versionType": "git"
            },
            {
              "lessThan": "3594aad97e7be2557ca9fa9c931b206b604028c8",
              "status": "affected",
              "version": "b07d5cc93e1b28df47a72c519d09d0a836043613",
              "versionType": "git"
            },
            {
              "lessThan": "60b4b5c1277fc491da9e1e7abab307bfa39c2db7",
              "status": "affected",
              "version": "b07d5cc93e1b28df47a72c519d09d0a836043613",
              "versionType": "git"
            },
            {
              "lessThan": "c84e125fff2615b4d9c259e762596134eddd2f27",
              "status": "affected",
              "version": "b07d5cc93e1b28df47a72c519d09d0a836043613",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33ab4dd6202f359558a0a2678b94d1b9994c17e5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1ecdc55e5cd9f70f8d7513802971d4cffb9f77af",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.247",
              "status": "affected",
              "version": "5.10.188",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.179",
              "status": "affected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.130",
              "status": "affected",
              "version": "6.1.39",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/overlayfs/copy_up.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.247",
                  "versionStartIncluding": "5.10.188",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.15.121",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.130",
                  "versionStartIncluding": "6.1.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.81",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.18",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\n\nThe issue was caused by dput(upper) being called before\novl_dentry_update_reval(), while upper-\u003ed_flags was still\naccessed in ovl_dentry_remote().\n\nMove dput(upper) after its last use to prevent use-after-free.\n\nBUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\nBUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:488\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\n ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\n ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n ovl_link_up fs/overlayfs/copy_up.c:610 [inline]\n ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170\n ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223\n ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136\n vfs_rename+0xf84/0x20a0 fs/namei.c:4893\n...\n \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local syscalls only \u2014 mounting overlayfs (and a FUSE upper) and issuing rename(2)/open(O_TRUNC) to trigger copy-up. No network-facing component processes attacker data on this path.\nAC:L - The attacker controls both halves of the timing: the FUSE server sets entry_valid=0 so dput() deterministically kills the dentry, and it stalls the SETATTR in ovl_set_timestamps() to hold the window open arbitrarily long for RCU to free the object and for a heap spray to refill the slot. No condition depends on chance or on unrelated system state.\nPR:L - Both overlayfs and fuse are FS_USERNS_MOUNT, so an ordinary unprivileged user can create the whole setup inside `unshare -Urm`, and several distros permit unprivileged overlayfs outright; the copy-up path contains no capability check. Some form of local account is required, so not None.\nUI:N - The attacker performs the mount, the FUSE service, and the rename entirely on their own, within their own namespace. No victim action of any kind is needed.\nS:U - The corrupted and disclosed state is kernel memory reached from a kernel-mode fault; the impact stays within the kernel\u0027s own security authority with no crossing into a hypervisor, IOMMU, or other authority.\nC:H - This is a slab use-after-free read of a freed struct dentry whose contents the attacker can shape by spraying the dentry_cache during the FUSE-controlled stall, and the read value is propagated into live VFS state, yielding an observable oracle on freed kernel memory. Per UAF scoring guidance this is High.\nI:H - Content read out of a freed, attacker-refillable slab object is written into a live dentry\u0027s d_flags, corrupting VFS revalidation state (stale dentries accepted on remote upper/lower filesystems). Use-after-free primitives of this class are treated as High integrity impact.\nA:H - KASAN confirms a slab-use-after-free; once the dentry slab page is returned to the page allocator \u2014 which the attacker can encourage by draining the dcache during the stall \u2014 the dereference faults and oopses the kernel, and the fault occurs with the upper directory inode lock held, wedging further operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:09.027Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f77618291836168eca99e89cd175256f928f5e64"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35"
        },
        {
          "url": "https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00"
        },
        {
          "url": "https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27"
        }
      ],
      "title": "ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21887",
    "datePublished": "2025-03-27T14:57:14.524Z",
    "dateReserved": "2024-12-29T08:45:45.782Z",
    "dateUpdated": "2026-08-05T11:55:09.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21887",
      "date": "2026-08-05",
      "epss": "0.00195",
      "percentile": "0.09447"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:52:27.000Z",
      "cve": "CVE-2025-21887",
      "id": "msrc_CVE-2025-21887",
      "initial_release_date": "2025-03-02T00:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21887.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21887\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-27T15:15:56.603\",\"lastModified\":\"2026-07-14T13:17:26.460\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\\n\\nThe issue was caused by dput(upper) being called before\\novl_dentry_update_reval(), while upper-\u003ed_flags was still\\naccessed in ovl_dentry_remote().\\n\\nMove dput(upper) after its last use to prevent use-after-free.\\n\\nBUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\\nBUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\\n\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\\n print_address_description mm/kasan/report.c:377 [inline]\\n print_report+0xc3/0x620 mm/kasan/report.c:488\\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\\n ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\\n ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\\n ovl_link_up fs/overlayfs/copy_up.c:610 [inline]\\n ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170\\n ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223\\n ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136\\n vfs_rename+0xf84/0x20a0 fs/namei.c:4893\\n...\\n \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ovl: Se corrige el UAF en ovl_dentry_update_reval moviendo dput() en ovl_link_up. El problema se deb\u00eda a que dput(upper) se llamaba antes de ovl_dentry_update_reval(), mientras que se segu\u00eda accediendo a upper-\u0026gt;d_flags en ovl_dentry_remote(). Se mueve dput(upper) despu\u00e9s de su \u00faltimo uso para evitar el use-after-free. ERROR: KASAN: slab-use-after-free en ovl_dentry_remote fs/overlayfs/util.c:162 [en l\u00ednea] ERROR: KASAN: slab-use-after-free en ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 Rastreo de llamadas:  __dump_stack lib/dump_stack.c:88 [en l\u00ednea] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [en l\u00ednea] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [en l\u00ednea] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [en l\u00ednea] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ... \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/overlayfs/copy_up.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"714ba10a6dd19752a349e59aa875f3288ccb59b9\",\"lessThan\":\"f77618291836168eca99e89cd175256f928f5e64\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"62f29ca45f832e281fc14966ac25f6ff3bd121ca\",\"lessThan\":\"4b49d939b5a79117f939b77cc67efae2694d9799\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e4f2a1feebb3f209a0fca82aa53507a5b8be4d53\",\"lessThan\":\"a7c41830ffcd17b2177a95a9b99b270302090c35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b07d5cc93e1b28df47a72c519d09d0a836043613\",\"lessThan\":\"64455c8051c3aedc71abb7ec8d47c80301f99f00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b07d5cc93e1b28df47a72c519d09d0a836043613\",\"lessThan\":\"3594aad97e7be2557ca9fa9c931b206b604028c8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b07d5cc93e1b28df47a72c519d09d0a836043613\",\"lessThan\":\"60b4b5c1277fc491da9e1e7abab307bfa39c2db7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b07d5cc93e1b28df47a72c519d09d0a836043613\",\"lessThan\":\"c84e125fff2615b4d9c259e762596134eddd2f27\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33ab4dd6202f359558a0a2678b94d1b9994c17e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1ecdc55e5cd9f70f8d7513802971d4cffb9f77af\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.188\",\"lessThan\":\"5.10.247\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.121\",\"lessThan\":\"5.15.179\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.39\",\"lessThan\":\"6.1.130\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.3.13\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.4.4\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/overlayfs/copy_up.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.247\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.179\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.130\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.81\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.18\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.6\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-03-27T16:59:58.510815Z\",\"id\":\"CVE-2025-21887\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.188\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"6D42E8C7-CD33-432A-AC09-DC524C88ECE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.121\",\"versionEndExcluding\":\"5.15.179\",\"matchCriteriaId\":\"C9B8E6A5-F0A2-421F-A00D-2CCDFDC86847\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.39\",\"versionEndExcluding\":\"6.1.130\",\"matchCriteriaId\":\"262D590B-5E13-4E7C-A88A-4C5A41908A0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3.13\",\"versionEndExcluding\":\"6.4\",\"matchCriteriaId\":\"9058C05B-5440-4D83-834D-2E94FC46621C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.4\",\"versionEndExcluding\":\"6.6.81\",\"matchCriteriaId\":\"D6B5A28B-A3A7-4D06-830C-DF7654268C9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.18\",\"matchCriteriaId\":\"3D5C8D9A-4013-4C1A-810F-AA540BB5737C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.6\",\"matchCriteriaId\":\"64F12D9B-71C2-4CD7-A288-0D5EF1709620\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f77618291836168eca99e89cd175256f928f5e64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T00:04:39+00:00",
      "cve": "CVE-2025-21887",
      "id": "CVE-2025-21887",
      "initial_release_date": "2025-03-27T00:00:00+00:00",
      "product_status:fixed": "891",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "84",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21887.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:03:22Z",
      "cve": "CVE-2025-21887",
      "id": "CVE-2025-21887",
      "initial_release_date": "2025-03-28T03:00:42Z",
      "product_status:known_affected": "497",
      "product_status:known_not_affected": "205",
      "product_status:recommended": "438",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21887",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21887.json",
      "version": "46"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:38:40.259Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-07-14T12:40:26.912Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21887\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-27T16:59:58.510815Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-27T16:59:59.833Z\"}}], \"cna\": {\"title\": \"ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached through local syscalls only \\u2014 mounting overlayfs (and a FUSE upper) and issuing rename(2)/open(O_TRUNC) to trigger copy-up. No network-facing component processes attacker data on this path.\\nAC:L - The attacker controls both halves of the timing: the FUSE server sets entry_valid=0 so dput() deterministically kills the dentry, and it stalls the SETATTR in ovl_set_timestamps() to hold the window open arbitrarily long for RCU to free the object and for a heap spray to refill the slot. No condition depends on chance or on unrelated system state.\\nPR:L - Both overlayfs and fuse are FS_USERNS_MOUNT, so an ordinary unprivileged user can create the whole setup inside `unshare -Urm`, and several distros permit unprivileged overlayfs outright; the copy-up path contains no capability check. Some form of local account is required, so not None.\\nUI:N - The attacker performs the mount, the FUSE service, and the rename entirely on their own, within their own namespace. No victim action of any kind is needed.\\nS:U - The corrupted and disclosed state is kernel memory reached from a kernel-mode fault; the impact stays within the kernel\u0027s own security authority with no crossing into a hypervisor, IOMMU, or other authority.\\nC:H - This is a slab use-after-free read of a freed struct dentry whose contents the attacker can shape by spraying the dentry_cache during the FUSE-controlled stall, and the read value is propagated into live VFS state, yielding an observable oracle on freed kernel memory. Per UAF scoring guidance this is High.\\nI:H - Content read out of a freed, attacker-refillable slab object is written into a live dentry\u0027s d_flags, corrupting VFS revalidation state (stale dentries accepted on remote upper/lower filesystems). Use-after-free primitives of this class are treated as High integrity impact.\\nA:H - KASAN confirms a slab-use-after-free; once the dentry slab page is returned to the page allocator \\u2014 which the attacker can encourage by draining the dcache during the stall \\u2014 the dereference faults and oopses the kernel, and the fault occurs with the upper directory inode lock held, wedging further operations.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"714ba10a6dd19752a349e59aa875f3288ccb59b9\", \"lessThan\": \"f77618291836168eca99e89cd175256f928f5e64\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"62f29ca45f832e281fc14966ac25f6ff3bd121ca\", \"lessThan\": \"4b49d939b5a79117f939b77cc67efae2694d9799\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e4f2a1feebb3f209a0fca82aa53507a5b8be4d53\", \"lessThan\": \"a7c41830ffcd17b2177a95a9b99b270302090c35\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b07d5cc93e1b28df47a72c519d09d0a836043613\", \"lessThan\": \"64455c8051c3aedc71abb7ec8d47c80301f99f00\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b07d5cc93e1b28df47a72c519d09d0a836043613\", \"lessThan\": \"3594aad97e7be2557ca9fa9c931b206b604028c8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b07d5cc93e1b28df47a72c519d09d0a836043613\", \"lessThan\": \"60b4b5c1277fc491da9e1e7abab307bfa39c2db7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b07d5cc93e1b28df47a72c519d09d0a836043613\", \"lessThan\": \"c84e125fff2615b4d9c259e762596134eddd2f27\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"33ab4dd6202f359558a0a2678b94d1b9994c17e5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1ecdc55e5cd9f70f8d7513802971d4cffb9f77af\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.188\", \"lessThan\": \"5.10.247\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.15.121\", \"lessThan\": \"5.15.179\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.39\", \"lessThan\": \"6.1.130\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.3.13\", \"lessThan\": \"6.4\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.4.4\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/overlayfs/copy_up.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.247\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.179\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.130\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.81\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/overlayfs/copy_up.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f77618291836168eca99e89cd175256f928f5e64\"}, {\"url\": \"https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799\"}, {\"url\": \"https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35\"}, {\"url\": \"https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00\"}, {\"url\": \"https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8\"}, {\"url\": \"https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7\"}, {\"url\": \"https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\\n\\nThe issue was caused by dput(upper) being called before\\novl_dentry_update_reval(), while upper-\u003ed_flags was still\\naccessed in ovl_dentry_remote().\\n\\nMove dput(upper) after its last use to prevent use-after-free.\\n\\nBUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\\nBUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\\n\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\\n print_address_description mm/kasan/report.c:377 [inline]\\n print_report+0xc3/0x620 mm/kasan/report.c:488\\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\\n ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\\n ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\\n ovl_link_up fs/overlayfs/copy_up.c:610 [inline]\\n ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170\\n ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223\\n ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136\\n vfs_rename+0xf84/0x20a0 fs/namei.c:4893\\n...\\n \u003c/TASK\u003e\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.247\", \"versionStartIncluding\": \"5.10.188\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.179\", \"versionStartIncluding\": \"5.15.121\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.130\", \"versionStartIncluding\": \"6.1.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.81\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.18\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.6\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.3.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.4.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:55:09.027Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21887\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:55:09.027Z\", \"dateReserved\": \"2024-12-29T08:45:45.782Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-03-27T14:57:14.524Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.