CVE-2025-21887

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up

The issue was caused by dput(upper) being called before

ovl_dentry_update_reval(), while upper->d_flags was still

accessed in ovl_dentry_remote().

Move dput(upper) after its last use to prevent use-after-free.

BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]

BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114

print_address_description mm/kasan/report.c:377 [inline]

print_report+0xc3/0x620 mm/kasan/report.c:488

kasan_report+0xd9/0x110 mm/kasan/report.c:601

ovl_dentry_remote fs/overlayfs/util.c:162 [inline]

ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167

ovl_link_up fs/overlayfs/copy_up.c:610 [inline]

ovl_copy_up_one+0x2105/0x3490 fs/overlayf

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References