High 7.8Published Mar 27, 2025

CVE-2025-21887ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up

Updated under an hour ago (Oct 27, 2026, 9:50 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still accessed in ovl_dentry_remote(). Move dput(upper) after its last use to prevent use-after-free. BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline] BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 ovl_dentry_remote fs/overlayfs/util.c:162 [inline] ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167 ovl_link_up fs/overlayfs/copy_up.c:610 [inline] ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170 ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223 ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136 vfs_rename+0xf84/0x20a0 fs/namei.c:4893 ... </TASK>

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 714ba10a6dd19752a349e59aa875f3288ccb59b9 before f77618291836168eca99e89cd175256f928f5e64; 62f29ca45f832e281fc14966ac25f6ff3bd121ca builds before 4b49d939b5a79117f939b77cc67efae2694d9799; from e4f2a1feebb3f209a0fca82aa53507a5b8be4d53 before a7c41830ffcd17b2177a95a9b99b270302090c35; from b07d5cc93e1b28df47a72c519d09d0a836043613 before 64455c8051c3aedc71abb7ec8d47c80301f99f00; from b07d5cc93e1b28df47a72c519d09d0a836043613 before 3594aad97e7be2557ca9fa9c931b206b604028c8; from b07d5cc93e1b28df47a72c519d09d0a836043613 before 60b4b5c1277fc491da9e1e7abab307bfa39c2db7; from b07d5cc93e1b28df47a72c519d09d0a836043613 before c84e125fff2615b4d9c259e762596134eddd2f27; 33ab4dd6202f359558a0a2678b94d1b9994c17e5; and 6 more ranges	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.10.188 before 5.11; from 5.15.121 before 5.15.179; from 6.1.39 before 6.1.130; from 6.3.13 before 6.4; from 6.4.4 before 6.6.81; from 6.7 before 6.12.18; from 6.13 before 6.13.6; 6.14; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/f77618291836168eca99e89cd175256f928f5e64
https://git.kernel.org/stable/c/4b49d939b5a79117f939b77cc67efae2694d9799	patch
https://git.kernel.org/stable/c/a7c41830ffcd17b2177a95a9b99b270302090c35	patch
https://git.kernel.org/stable/c/64455c8051c3aedc71abb7ec8d47c80301f99f00	patch
https://git.kernel.org/stable/c/3594aad97e7be2557ca9fa9c931b206b604028c8	patch
https://git.kernel.org/stable/c/60b4b5c1277fc491da9e1e7abab307bfa39c2db7	patch
https://git.kernel.org/stable/c/c84e125fff2615b4d9c259e762596134eddd2f27	patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.