{"id":"CVE-2025-21664","revision":"f46acb7094b647d4969cd7e244f32af1","records":[{"revision":"f46acb7094b647d4969cd7e244f32af1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-21664","aliases":[],"title":"dm thin: make get_first_thin use rcu-safe list first function","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: make get_first_thin use rcu-safe list first function\n\nThe documentation in rculist.h explains the absence of list_empty_rcu()\nand cautions programmers against relying on a list_empty() ->\nlist_first() sequence in RCU safe code.  This is because each of these\nfunctions performs its own READ_ONCE() of the list head.  This can lead\nto a situation where the list_empty() sees a valid list entry, but the\nsubsequent list_first() sees a different view of list head state after a\nmodification.\n\nIn the case of dm-thin, this author had a production box crash from a GP\nfault in the process_deferred_bios path.  This function saw a valid list\nhead in get_first_thin() but when it subsequently dereferenced that and\nturned it into a thin_c, it got the inside of the struct pool, since the\nlist was now empty and referring to itself.  The kernel on which this\noccurred printed both a warning about a refcount_t being saturated, and\na UBSAN error for an out-of-bounds cpuid access in the queued spinlock,\nprior to the fault itself.  When the resulting kdump was examined, it\nwas possible to see another thread patiently waiting in thin_dtr's\nsynchronize_rcu.\n\nThe thin_dtr call managed to pull the thin_c out of the active thins\nlist (and have it be the last entry in the active_thins list) at just\nthe wrong moment which lead to this crash.\n\nFortunately, the fix here is straight forward.  Switch get_first_thin()\nfunction to use list_first_or_null_rcu() which performs just a single\nREAD_ONCE() and returns NULL if the list is already empty.\n\nThis was run against the devicemapper test suite's thin-provisioning\nsuites for delete and suspend and no regressions were observed.","state":0,"publishedAt":"2025-01-21T12:18:19.015+00:00","modifiedAt":"2026-10-15T21:51:52.113+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-thin.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\n                            \"lessThan\": \"ec037fe8c0d0f6140e3d8a49c7b29cb5582160b8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\n                            \"lessThan\": \"cd30a3960433ec2db94b3689752fa3c5df44d649\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\n                            \"lessThan\": \"802666a40c71a23542c43a3f87e3a2d0f4e8fe45\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\n                            \"lessThan\": \"12771050b6d059eea096993bf2001da9da9fddff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\n                            \"lessThan\": \"6b305e98de0d225ccebfb225730a9f560d28ecb0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\n                            \"lessThan\": \"cbd0d5ecfa390ac29c5380200147d09c381b2ac6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\n                            \"lessThan\": \"80f130bfad1dab93b95683fc39b87235682b8f72\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/md/dm-thin.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.290\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.234\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.177\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.125\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.72\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.10\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/ec037fe8c0d0f6140e3d8a49c7b29cb5582160b8","https://git.kernel.org/stable/c/cd30a3960433ec2db94b3689752fa3c5df44d649","https://git.kernel.org/stable/c/802666a40c71a23542c43a3f87e3a2d0f4e8fe45","https://git.kernel.org/stable/c/12771050b6d059eea096993bf2001da9da9fddff","https://git.kernel.org/stable/c/6b305e98de0d225ccebfb225730a9f560d28ecb0","https://git.kernel.org/stable/c/cbd0d5ecfa390ac29c5380200147d09c381b2ac6","https://git.kernel.org/stable/c/80f130bfad1dab93b95683fc39b87235682b8f72"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21664","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-21664","identifiers":["CVE-2025-21664"]},"retained":false,"historicalAffected":[]}],"coverage":[]}