CVE-2025-21672 afs: Fix merge preference rule failure condition
A local attacker can trigger a denial of service in the Linux kernel AFS module by causing a lock to remain held when returning to userspace.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21672?
CVE-2025-21672 is a medium-severity vulnerability in Linux kernel, published on 31 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
afs: Fix merge preference rule failure condition
syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released.
Fix this by store the error in ret and jump to done to clean up instead of returning directly.
[dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()]
[1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted ------------------------------------------------ syz-executor133/5823 is leaving the kernel with locks still held! 1 lock held by syz-executor133/5823: #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline] #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: afs_proc_addr_prefs_write+0x2bb/0x14e0 fs/afs/addr_prefs.c:388
Weakness: CWE-667
Which versions are affected by CVE-2025-21672?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21672?
Apply the vendor's patch.
Is CVE-2025-21672 being exploited?
There is no known exploitation of CVE-2025-21672 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-56285, AZL-56327, BELL-CVE-2025-21672, DEBIAN-CVE-2025-21672, GHSA-94vp-7849-58r6, ROOT-OS-UBUNTU-2204-CVE-2025-21672 and 1 more.