CVE-2025-21664

What it actually does

Race condition in Linux kernel dm-thin module where get_first_thin performs non-atomic list_empty() followed by list_first() under RCU, allowing concurrent thin_dtr to empty the active_thins list and cause invalid dereference or GP fault in process_deferred_bios.

Why it matters to the business

Systems using thin provisioning may experience kernel crashes and downtime during device deletion or suspend operations; low exploitability but high impact on storage stability in production environments with many dependents.

How an attack unfolds

A local attacker triggers concurrent thin device creation/deletion while deferred bios are processed; timing allows thin_dtr's synchronize_rcu to remove the last list entry exactly when get_first_thin reads a stale head, leading to dereference of pool struct instead of thin_c.

How to fix it

Upgrade Linux kernel to commit ec037fe8c0d0f6140e3d8a49c7b29cb5582160b8 or later; rebuild and reboot with fixed dm-thin code using list_first_or_null_rcu.

How to confirm the fix worked

Verify source contains list_first_or_null_rcu call in get_first_thin; run device-mapper thin-provisioning delete/suspend test suites; confirm no GP faults or refcount saturation warnings in dmesg after updates.

Typical attack path

1. Obtain local access on affected Linux kernel
2. Create and delete thin devices while triggering I/O
3. Force race window between list_empty and list_first in get_first_thin
4. Cause kernel fault during process_deferred_bios

How to detect it

Search kernel logs and kdump artifacts for GP faults in process_deferred_bios, refcount_t saturation warnings, UBSAN cpuid errors, or threads stuck in thin_dtr synchronize_rcu around thin device operations.

• GP fault in process_deferred_bios
• refcount_t being saturated
• UBSAN error for out-of-bounds cpuid access
• thread waiting in thin_dtr's synchronize_rcu

What your security team should do

• Prioritize kernel updates on all systems using dm-thin
• Monitor kernel logs for dm-thin related faults and refcount warnings
• Restrict local user access on storage servers until patched
• Test thin provisioning workloads post-upgrade