{"id":"CVE-2025-21887","title":"In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\n\nThe issue was caused by dput(upper) being called before\novl_dentry_update_reval(), while upper-…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\n\nThe issue was caused by dput(upper) being called before\novl_dentry_update_reval(), while upper-…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.10.188, < 5.11","linux_kernel >= 5.15.121, < 5.15.179","linux_kernel >= 6.1.39, < 6.1.130","linux_kernel >= 6.3.13, < 6.4","linux_kernel >= 6.4.4, < 6.6.81","linux_kernel >= 6.7, < 6.12.18","linux_kernel >= 6.13, < 6.13.6","linux_kernel = 6.14"],"patched":["linux_kernel 6.13.6"],"published":"2025-03-27","updated":"2026-07-14","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-21887","references":[{"url":"https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f77618291836168eca99e89cd175256f928f5e64","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00213,"epssPercentile":0.11883,"ingestedAt":"2026-07-14T13:36:56.015Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-03-27T16:59:58.510815Z"},"slug":"CVE-2025-21887","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\n\nThe issue was caused by dput(upper) being called before\novl_dentry_update_reval(), while upper->d_flags was still\naccessed in ovl_dentry_remote().\n\nMove dput(upper) after its last use to prevent use-after-free.\n\nBUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\nBUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:488\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\n ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\n ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n ovl_link_up fs/overlayfs/copy_up.c:610 [inline]\n ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170\n ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223\n ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136\n vfs_rename+0xf84/0x20a0 fs/namei.c:4893\n...\n </TASK>\n\n## Affected\n\n- `linux_kernel >= 5.10.188, < 5.11`\n- `linux_kernel >= 5.15.121, < 5.15.179`\n- `linux_kernel >= 6.1.39, < 6.1.130`\n- `linux_kernel >= 6.3.13, < 6.4`\n- `linux_kernel >= 6.4.4, < 6.6.81`\n- `linux_kernel >= 6.7, < 6.12.18`\n- `linux_kernel >= 6.13, < 6.13.6`\n- `linux_kernel = 6.14`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.13.6`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}