by Kastro
Paper/Archive/CVE-2025-21988

CVE-2025-21988

Linux Linux — fs/netfs/read_collect: add to next->prev_donated

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 33.8.338 × 206.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: fs/netfs/read_collect: add to next->prev_donated If multiple subrequests donate data to the same "next" request (depending on the subrequest completion order), each of them would overwrite the `prev_donated` field, causing data corruption and a BUG() crash ("Can't donate prior to front").

Affected

ProductAffectedFixed inSource
Linuxee4cdf7ba857a894ad1650d6ab77669cbbfa329e – < 62b9ad7e52d4777f7e775ee1f0ad2452f604102462b9ad7e52d4777f7e775ee1f0ad2452f6041024CNA
Linuxee4cdf7ba857a894ad1650d6ab77669cbbfa329e – < e25cec3b76aba47a49138d2162fc809c6cd49c9ee25cec3b76aba47a49138d2162fc809c6cd49c9eCNA
Linuxee4cdf7ba857a894ad1650d6ab77669cbbfa329e – < e2d46f2ec332533816417b60933954173f602121e2d46f2ec332533816417b60933954173f602121CNA
Linux6.126.12.20CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgit.kernel.org/stable/c/62b9ad7e52d4777f7e775ee1f0ad2452f6041024refgit.kernel.org/stable/c/e25cec3b76aba47a49138d2162fc809c6cd49c9erefgit.kernel.org/stable/c/e2d46f2ec332533816417b60933954173f602121