CVE-2025-21643

What it actually does

The netfs subsystem incorrectly routes kernel-initiated asynchronous direct I/O using bio_vec arrays through netfs_extract_user_iter, which only supports IOVEC/UBUF iterators, resulting in a warning and failed write operations.

Why it matters to the business

Kernel writes through certain filesystems like CIFS combined with loop devices can fail unexpectedly, leading to data loss or application errors on systems running the affected kernel versions.

How an attack unfolds

An attacker or automated process mounts a CIFS share, creates a file, attaches it as a loopback device with direct I/O enabled, and performs writes that trigger the faulty async DIO path, causing the operation to abort with a kernel warning.

How to fix it

Update the Linux kernel to the fixed commit 9f3a265836844eda30bf34c2584b8011fd4f0f49 or later; for listed IBM Java packages apply the specified fixed versions such as 1:1.7.0.9.50-1jpp.1.el5_11.

How to confirm the fix worked

Verify the running kernel contains commit 9f3a265836844eda30bf34c2584b8011fd4f0f49; reproduce the loopback write test case and confirm absence of the netfs_extract_user_iter warning.

Typical attack path

1. Mount remote CIFS share
2. Create file on share
3. Attach file as loop device with --direct-io=on
4. Issue write to loop device
5. Kernel routes async DIO through netfs_extract_user_iter
6. Operation fails with warning

How to detect it

Search kernel logs for the warning at fs/netfs/iterator.c involving netfs_extract_user_iter and failed writes involving loop or CIFS devices; check for recent failed dd or similar I/O operations on affected paths.

What your security team should do

• Prioritize kernel updates on systems using CIFS with loop devices or kernel async DIO
• Monitor syslog for netfs_extract_user_iter warnings
• Apply fixed package versions for any affected IBM Java components