CVE-2025-21811 nilfs2: protect access to buffers with no active references
A race condition in the nilfs2 filesystem allows attackers to trigger a use-after-free, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21811?
CVE-2025-21811 is a high-severity use after free vulnerability in Linux kernel, published on 27 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: protect access to buffers with no active references
nilfs_lookup_dirty_data_buffers(), which iterates through the buffers attached to dirty data folios/pages, accesses the attached buffers without locking the folios/pages.
For data cache, nilfs_clear_folio_dirty() may be called asynchronously when the file system degenerates to read only, so nilfs_lookup_dirty_data_buffers() still has the potential to cause use after free issues when buffers lose the protection of their dirty state midway due to this asynchronous clearing and are unintentionally freed by try_to_free_buffers().
Eliminate this race issue by adjusting the lock section in this function.
Weakness: CWE-416
Which versions are affected by CVE-2025-21811?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21811?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-21811 being exploited?
There is no known exploitation of CVE-2025-21811 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21811, DEBIAN-CVE-2025-21811, GHSA-j2gc-738w-q744, ROOT-OS-UBUNTU-2404-CVE-2025-21811, UBUNTU-CVE-2025-21811.