CVE-2025-21896 (GCVE-0-2025-21896)
Vulnerability from cvelistv5
Published
2025-04-01 15:26
Modified
2025-05-04 07:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: fuse: revert back to __readahead_folio() for readahead In commit 3eab9d7bc2f4 ("fuse: convert readahead to use folios"), the logic was converted to using the new folio readahead code, which drops the reference on the folio once it is locked, using an inferred reference on the folio. Previously we held a reference on the folio for the entire duration of the readpages call. This is fine, however for the case for splice pipe responses where we will remove the old folio and splice in the new folio (see fuse_try_move_page()), we assume that there is a reference held on the folio for ap->folios, which is no longer the case. To fix this, revert back to __readahead_folio() which allows us to hold the reference on the folio for the duration of readpages until either we drop the reference ourselves in fuse_readpages_end() or the reference is dropped after it's replaced in the page cache in the splice case. This will fix the UAF bug that was reported.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3eab9d7bc2f4ae7f3f9c9c7852ff61600df79856
Version: 3eab9d7bc2f4ae7f3f9c9c7852ff61600df79856
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c",
            "fs/fuse/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "60db11f1b7fba4a66b117ea998d965818784a98d",
              "status": "affected",
              "version": "3eab9d7bc2f4ae7f3f9c9c7852ff61600df79856",
              "versionType": "git"
            },
            {
              "lessThan": "0c67c37e1710b2a8f61c8a02db95a51fe577e2c1",
              "status": "affected",
              "version": "3eab9d7bc2f4ae7f3f9c9c7852ff61600df79856",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c",
            "fs/fuse/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: revert back to __readahead_folio() for readahead\n\nIn commit 3eab9d7bc2f4 (\"fuse: convert readahead to use folios\"), the\nlogic was converted to using the new folio readahead code, which drops\nthe reference on the folio once it is locked, using an inferred\nreference on the folio. Previously we held a reference on the folio for\nthe entire duration of the readpages call.\n\nThis is fine, however for the case for splice pipe responses where we\nwill remove the old folio and splice in the new folio (see\nfuse_try_move_page()), we assume that there is a reference held on the\nfolio for ap-\u003efolios, which is no longer the case.\n\nTo fix this, revert back to __readahead_folio() which allows us to hold\nthe reference on the folio for the duration of readpages until either we\ndrop the reference ourselves in fuse_readpages_end() or the reference is\ndropped after it\u0027s replaced in the page cache in the splice case.\nThis will fix the UAF bug that was reported."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:23:44.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/60db11f1b7fba4a66b117ea998d965818784a98d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c67c37e1710b2a8f61c8a02db95a51fe577e2c1"
        }
      ],
      "title": "fuse: revert back to __readahead_folio() for readahead",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21896",
    "datePublished": "2025-04-01T15:26:49.200Z",
    "dateReserved": "2024-12-29T08:45:45.783Z",
    "dateUpdated": "2025-05-04T07:23:44.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21896\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:19.987\",\"lastModified\":\"2025-04-01T20:26:01.990\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfuse: revert back to __readahead_folio() for readahead\\n\\nIn commit 3eab9d7bc2f4 (\\\"fuse: convert readahead to use folios\\\"), the\\nlogic was converted to using the new folio readahead code, which drops\\nthe reference on the folio once it is locked, using an inferred\\nreference on the folio. Previously we held a reference on the folio for\\nthe entire duration of the readpages call.\\n\\nThis is fine, however for the case for splice pipe responses where we\\nwill remove the old folio and splice in the new folio (see\\nfuse_try_move_page()), we assume that there is a reference held on the\\nfolio for ap-\u003efolios, which is no longer the case.\\n\\nTo fix this, revert back to __readahead_folio() which allows us to hold\\nthe reference on the folio for the duration of readpages until either we\\ndrop the reference ourselves in fuse_readpages_end() or the reference is\\ndropped after it\u0027s replaced in the page cache in the splice case.\\nThis will fix the UAF bug that was reported.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fuse: volver a __readahead_folio() para readahead. En el commit 3eab9d7bc2f4 (\\\"fuse: convertir readahead para usar folios\\\"), la l\u00f3gica se convirti\u00f3 para usar el nuevo c\u00f3digo de readahead de folio, que elimina la referencia en el folio una vez bloqueado, usando una referencia inferida en el folio. Anteriormente, manten\u00edamos una referencia en el folio durante toda la duraci\u00f3n de la llamada a readpages. Esto es correcto, sin embargo, para el caso de las respuestas de la tuber\u00eda de empalme donde eliminaremos el folio antiguo y empalmaremos en el nuevo folio (ver fuse_try_move_page()), asumimos que hay una referencia mantenida en el folio para ap-\u0026gt;folios, lo cual ya no es el caso. Para solucionar esto, vuelva a __readahead_folio(), que nos permite mantener la referencia en el folio durante la lectura de p\u00e1ginas hasta que la eliminemos nosotros mismos en fuse_readpages_end() o hasta que se elimine tras ser reemplazada en la cach\u00e9 de p\u00e1ginas en el caso de empalme. Esto solucionar\u00e1 el error de UAF reportado.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c67c37e1710b2a8f61c8a02db95a51fe577e2c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/60db11f1b7fba4a66b117ea998d965818784a98d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.