{
  "threat_severity" : "Moderate",
  "public_date" : "2025-03-27T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up",
    "id" : "2355405",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2355405"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\nThe issue was caused by dput(upper) being called before\novl_dentry_update_reval(), while upper->d_flags was still\naccessed in ovl_dentry_remote().\nMove dput(upper) after its last use to prevent use-after-free.\nBUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\nBUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\nCall Trace:\n<TASK>\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\nprint_address_description mm/kasan/report.c:377 [inline]\nprint_report+0xc3/0x620 mm/kasan/report.c:488\nkasan_report+0xd9/0x110 mm/kasan/report.c:601\novl_dentry_remote fs/overlayfs/util.c:162 [inline]\novl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\novl_link_up fs/overlayfs/copy_up.c:610 [inline]\novl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170\novl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223\novl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136\nvfs_rename+0xf84/0x20a0 fs/namei.c:4893\n...\n</TASK>", "A use after free vulnerability exists in the linux kernel such that dput(upper) is being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote()." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-06-16T00:00:00Z",
    "advisory" : "RHSA-2025:9079",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.0",
    "package" : "kernel-0:6.12.0-55.17.1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-07-07T00:00:00Z",
    "advisory" : "RHSA-2025:10379",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.25.1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-07-07T00:00:00Z",
    "advisory" : "RHSA-2025:10379",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-570.25.1.el9_6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-07-28T00:00:00Z",
    "advisory" : "RHSA-2025:11810",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "kernel-0:5.14.0-427.79.1.el9_4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-21887\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21887\nhttps://lore.kernel.org/linux-cve-announce/2025032714-CVE-2025-21887-48e8@gregkh/T" ],
  "name" : "CVE-2025-21887",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}