CVE-2025-21665

What it actually does

On 32-bit Linux kernels, folio_seek_hole_data() inadvertently truncates a 64-bit offset to 32 bits, resulting in an infinite loop during write operations to XFS filesystems.

Why it matters to the business

32-bit Linux systems using XFS may experience application or system hangs during file writes, leading to loss of availability and potential operational disruption across affected environments.

How an attack unfolds

An attacker with the ability to perform writes on an XFS filesystem on a vulnerable 32-bit kernel invokes folio_seek_hole_data() through normal or crafted write activity; the 64-to-32-bit truncation causes the function to repeatedly process the same offset, entering an infinite loop that stalls the process or kernel thread.

How to fix it

Upgrade the Linux kernel to a version containing commit 64e5fd96330df2ad278d1c4edcca581f26e5f76e or a later stable release that resolves the truncation issue.

How to confirm the fix worked

Confirm the running kernel contains the referenced fix commit, then exercise write workloads on XFS to verify absence of looping behavior; inspect kernel changelog and source for the corrected 64-bit handling.

Typical attack path

1. Identify 32-bit Linux kernel with XFS filesystem in use
2. Obtain write access to a file or directory on the XFS volume
3. Issue write operations that reach folio_seek_hole_data()
4. Trigger repeated truncation of the 64-bit offset, entering infinite loop

How to detect it

Review system and kernel logs for repeated or stalled write operations on XFS, monitor for processes stuck in uninterruptible sleep during file I/O, and correlate with 32-bit architecture indicators.

What your security team should do

• Apply the kernel fix to all 32-bit systems using XFS as highest priority
• Inventory 32-bit deployments and plan migration to 64-bit kernels where feasible
• Monitor stable kernel releases for backports and schedule testing