CVE-2025-21654

What it actually does

Failure to encode overlayfs file handles from inodes lacking dentry aliases after cache drops, breaking fid reporting for FAN_DELETE_SELF fanotify events and inotify fdinfo.

Why it matters to the business

Monitoring and security tools relying on fanotify events for overlayfs may miss critical file deletion notifications, increasing risk of undetected changes on systems using affected JBoss EAP 6 deployments; low EPSS and no KEV indicate limited active threat but patch urgency remains for event reliability after 630 days.

How an attack unfolds

An attacker triggers dentry alias discard via drop_caches on overlayfs watched inodes then performs file operations expected to generate FAN_DELETE_SELF events; the missing fid encoding allows evasion of fanotify-based detection without direct code execution.

How to fix it

Upgrade all listed JBoss EAP 6 packages on el5 to version 0:7.5.11-1.Final_redhat_1.1.ep6.el5 or later to incorporate the kernel overlayfs fix deferring alias lookup.

How to confirm the fix worked

Verify installed package versions match the fixed 7.5.11-1.Final_redhat_1.1.ep6.el5 releases; reproduce LTP-style fanotify tests on overlayfs after drop_caches to confirm fid encoding succeeds.

Typical attack path

1. Trigger drop_caches to discard dentry aliases on overlayfs inodes
2. Set up fanotify watch for FAN_DELETE_SELF on affected overlayfs paths
3. Perform delete or self-delete operation on watched inode
4. Observe absence of fid in generated events due to ovl_encode_fh failure

How to detect it

Review kernel and fanotify logs for overlayfs fid encoding failures or missing FAN_DELETE_SELF events after cache flush operations; correlate with inotify_show_fdinfo warnings in environments using affected JBoss packages.

What your security team should do

• Apply the listed package upgrades immediately across all affected JBoss EAP 6 el5 environments
• Audit overlayfs usage with fanotify-dependent monitoring and test event fidelity post-upgrade
• Monitor EPSS and KEV updates for any change in exploit likelihood