CVE-2025-21811

nilfs2: protect access to buffers with no active references

High · published February 27, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: protect access to buffers with no active references

nilfs_lookup_dirty_data_buffers(), which iterates through the buffers

attached to dirty data folios/pages, accesses the attached buffers without

locking the folios/pages.

For data cache, nilfs_clear_folio_dirty() may be called asynchronously

when the file system degenerates to read only, so

nilfs_lookup_dirty_data_buffers() still has the potential to cause use

after free issues when buffers lose the protection of their dirty state

midway due to this asynchronous clearing and are unintentionally freed by

try_to_free_buffers().

Eliminate this race issue by adjusting the lock section in this function.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.1th percentile
Published
2025-02-27T20:01Z
EPSS history
Timeline
  • 27 FEB 20:01Z
    nilfs2: protect access to buffers with no active references
    cvelistv5