CVE-2025-21699

What it actually does

Failure to truncate an inode's address space when flipping the GFS2_DIF_JDATA flag allows mixing of buffer heads and iomap_folio_state structs on pages, resulting in memory corruption within the Linux kernel GFS2 filesystem.

Why it matters to the business

System instability, crashes, or data corruption on Linux systems using GFS2, increasing downtime and operational risk across widely deployed environments; older publication date and low EPSS indicate limited active exploitation but still requires attention due to kernel prevalence.

How an attack unfolds

A local attacker manipulates GFS2 inodes to trigger a JDATA flag change without address space truncation, causing incompatible page state structures to coexist and leading to memory corruption that may enable denial of service or further exploitation.

How to fix it

Upgrade to fixed versions including createrepo_c 0.17.2-3.el8 and Linux kernel commit 8c41abc11aa8438c9ed2d973f97e66674c0355df or later for all affected packages.

How to confirm the fix worked

Confirm updated package versions match the fixed releases and verify GFS2 inode operations no longer mix buffer heads with iomap structures.

Typical attack path

1. Obtain local access on a target Linux system
2. Access or create a GFS2 filesystem
3. Perform operations that flip the GFS2_DIF_JDATA flag on an inode
4. Trigger mixing of page structures to induce memory corruption

How to detect it

Review kernel logs for GFS2-related address space truncation failures or memory corruption warnings during inode flag operations.

What your security team should do

• Apply kernel and package updates to fixed versions without delay
• Audit systems for GFS2 usage and test flag flip scenarios post-update
• Monitor kernel logs for GFS2 address space errors