CVE-2025-37863

ovl: don't allow datadir only

published May 9, 2025

CVSS
—
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ovl: don't allow datadir only

In theory overlayfs could support upper layer directly referring to a data

layer, but there's no current use case for this.

Originally, when data-only layers were introduced, this wasn't allowed,

only introduced by the "datadir+" feature, but without actually handling

this case, resulting in an Oops.

Fix by disallowing datadir without lowerdir.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Published
2025-05-09T06:43Z
EPSS history
Timeline
  • 09 MAY 06:43Z
    ovl: don't allow datadir only
    cvelistv5