CVE-2025-21664

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dm thin: make get_first_thin use rcu-safe list first function

The documentation in rculist.h explains the absence of list_empty_rcu()

and cautions programmers against relying on a list_empty() ->

list_first() sequence in RCU safe code. This is because each of these

functions performs its own READ_ONCE() of the list head. This can lead

to a situation where the list_empty() sees a valid list entry, but the

subsequent list_first() sees a different view of list head state after a

modification.

In the case of dm-thin, this author had a production box crash from a GP

fault in the process_deferred_bios path. This function saw a valid list

head in get_first_thin() but when it subsequently dereferenced that and

turned it into a thin_c, it got the inside of the struct pool, since the

list was now empty and referring to itself. The kernel on which this

occurred printed both a warning about a refcount_t being saturated, and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References