logo_clicknbuy.png

CVE-2025-21643 – “CIFS Netfs Linux Kernel Async DIO Handling Vulnerability”

The following table lists the changes that have been made to the
CVE-2025-21643 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jan. 19, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved:

    netfs: Fix kernel async DIO

    Netfslib needs to be able to handle kernel-initiated asynchronous DIO that
    is supplied with a bio_vec[] array. Currently, because of the async flag,
    this gets passed to netfs_extract_user_iter() which throws a warning and
    fails because it only handles IOVEC and UBUF iterators. This can be
    triggered through a combination of cifs and a loopback blockdev with
    something like:

    mount //my/cifs/share /foo
    dd if=/dev/zero of=/foo/m0 bs=4K count=1K
    losetup –sector-size 4096 –direct-io=on /dev/loop2046 /foo/m0
    echo hello >/dev/loop2046

    This causes the following to appear in syslog:

    WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs]

    and the write to fail.

    Fix this by removing the check in netfs_unbuffered_write_iter_locked() that
    causes async kernel DIO writes to be handled as userspace writes. Note
    that this change relies on the kernel caller maintaining the existence of
    the bio_vec array (or kvec[] or folio_queue) until the op is complete.
    Added Reference https://git.kernel.org/stable/c/3f6bc9e3ab9b127171d39f9ac6eca1abb693b731
    Added Reference https://git.kernel.org/stable/c/9f3a265836844eda30bf34c2584b8011fd4f0f49
Share the Post:

Related Posts