{"id":"CVE-2025-21887","revision":"8a45d8597e6b490c89c58b999bd1b028","records":[{"revision":"8a45d8597e6b490c89c58b999bd1b028","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-21887","aliases":[],"title":"ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up","description":"In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\n\nThe issue was caused by dput(upper) being called before\novl_dentry_update_reval(), while upper->d_flags was still\naccessed in ovl_dentry_remote().\n\nMove dput(upper) after its last use to prevent use-after-free.\n\nBUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\nBUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:488\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\n ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\n ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n ovl_link_up fs/overlayfs/copy_up.c:610 [inline]\n ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170\n ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223\n ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136\n vfs_rename+0xf84/0x20a0 fs/namei.c:4893\n...\n </TASK>","state":0,"publishedAt":"2025-03-27T14:57:14.524+00:00","modifiedAt":"2026-10-15T01:05:05.402+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/overlayfs/copy_up.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"714ba10a6dd19752a349e59aa875f3288ccb59b9\",\n                            \"lessThan\": \"f77618291836168eca99e89cd175256f928f5e64\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"62f29ca45f832e281fc14966ac25f6ff3bd121ca\",\n                            \"lessThan\": \"4b49d939b5a79117f939b77cc67efae2694d9799\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e4f2a1feebb3f209a0fca82aa53507a5b8be4d53\",\n                            \"lessThan\": \"a7c41830ffcd17b2177a95a9b99b270302090c35\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b07d5cc93e1b28df47a72c519d09d0a836043613\",\n                            \"lessThan\": \"64455c8051c3aedc71abb7ec8d47c80301f99f00\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b07d5cc93e1b28df47a72c519d09d0a836043613\",\n                            \"lessThan\": \"3594aad97e7be2557ca9fa9c931b206b604028c8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b07d5cc93e1b28df47a72c519d09d0a836043613\",\n                            \"lessThan\": \"60b4b5c1277fc491da9e1e7abab307bfa39c2db7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b07d5cc93e1b28df47a72c519d09d0a836043613\",\n                            \"lessThan\": \"c84e125fff2615b4d9c259e762596134eddd2f27\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"33ab4dd6202f359558a0a2678b94d1b9994c17e5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1ecdc55e5cd9f70f8d7513802971d4cffb9f77af\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.188\",\n                            \"lessThan\": \"5.10.247\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.121\",\n                            \"lessThan\": \"5.15.179\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.39\",\n                            \"lessThan\": \"6.1.130\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.3.13\",\n                            \"lessThan\": \"6.4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.4.4\",\n                            \"lessThan\": \"6.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/overlayfs/copy_up.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.5\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.247\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.179\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.130\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.81\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.18\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13.6\",\n                            \"lessThanOrEqual\": \"6.13.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/f77618291836168eca99e89cd175256f928f5e64","https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799","https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35","https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00","https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8","https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7","https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21887","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-21887","identifiers":["CVE-2025-21887"]},"retained":false,"historicalAffected":[]}],"coverage":[]}