Cloudanix VulnDB

CVE-2025-21721

None

CVSS

—

EPSS

0.2%

Published

Feb 27, 2025

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how the system handles certain file-renaming tasks on a specific filesystem can cause computers to crash unexpectedly.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing error handling for nilfs_prepare_chunk() failures in nilfs_set_link(), nilfs_delete_entry(), and nilfs_rename() allows metadata corruption or other errors to trigger BUG_ON checks during directory entry rewrites on nilfs2.

Why it matters to the business

Systems using the affected Linux kernel with nilfs2 can experience unexpected crashes or instability during file or directory rename operations, especially on corrupted metadata; 98 downstream dependents increase potential operational disruption across ecosystems.

How an attack unfolds

An attacker triggers rename operations on a nilfs2 filesystem containing metadata corruption, causing nilfs_prepare_chunk() to fail via nilfs_get_block(); the unhandled error hits legacy BUG_ON checks leading to kernel panic. Related threat actor activity around Linux kernel privilege escalation CVEs may attempt similar filesystem manipulation.

How to fix it

Apply the fix from commit b38c6c260c2415c7f0968871305e7a093daabb4c in the Linux kernel stable tree; upgrade affected packages to fixed versions such as org/pub/scm/linux/kernel/git/stable/linux.git (GIT) at b38c6c260c2415c7f0968871305e7a093daabb4c or django (PyPI) 2.0.2 / 1.11.10 where applicable.

How to confirm the fix worked

Verify kernel builds contain the error-path additions in nilfs_set_link(), nilfs_delete_entry(), and nilfs_rename(); re-run syzbot-style rename fuzzing on crafted nilfs2 images to confirm BUG_ON no longer triggers.

Typical attack path

  1. Identify or create a nilfs2 filesystem with metadata inconsistencies
  2. Perform targeted rename operations on directories or files
  3. Trigger nilfs_prepare_chunk() failure path during entry rewrite
  4. Exploit unhandled error to hit BUG_ON and induce kernel crash

How to detect it

Search kernel logs and crash dumps for BUG_ON messages or nilfs2 directory entry errors during rename; correlate with filesystem metadata checks and any attempts to trigger nilfs_get_block failures.

  • BUG_ON.*nilfs_set_link
  • BUG_ON.*nilfs_delete_entry
  • nilfs_rename:.*prepare_chunk
  • nilfs2.*metadata corruption.*rename

What your security team should do

  • Prioritize patching Linux kernels using nilfs2 within the next maintenance window given 608 days since publication
  • Audit systems for nilfs2 usage and schedule upgrades to the listed fixed commits
  • Monitor for kernel oops or BUG reports involving nilfs_rename during routine operations

The record

In the Linux kernel, the following vulnerability has been resolved: nilfs2: handle errors that nilfs_prepare_chunk() may return Patch series "nilfs2: fix issues with rename operations". This series fixes BUG_ON check failures reported by syzbot around rename operations, and a minor behavioral issue where the mtime of a child directory changes when it is renamed instead of moved. This patch (of 2): The directory manipulation routines nilfs_set_link() and nilfs_delete_entry() rewrite the directory entry in the folio/page previously read by nilfs_find_entry(), so error handling is omitted on the assumption that nilfs_prepare_chunk(), which prepares the buffer for rewriting, will always succeed for these. And if an error is returned, it triggers the legacy BUG_ON() checks in each routine. This assumption is wrong, as proven by syzbot: the buffer layer called by nilfs_prepare_chunk() may call nilfs_get_block() if necessary, which may fail due to metadata corruption or other reasons. This has been there all along, but improved sanity checks and error handling may have made it more reproducible in fuzzing tests. Fix this issue by adding missing error paths in nilfs_set_link(), nilfs_delete_entry(), and their caller nilfs_rename().

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:11 linux-6.1 0 6.1.137-1~deb11u1
Debian:12 linux 0 No fix
Debian:12 linux 0 6.1.133-1
Debian:13 linux 0 No fix
Debian:13 linux 0 6.12.13-1
Linux Kernel 2.6.30 5.4.291
Ubuntu:24.10 linux-aws 0 6.11.0-1014.15

Related vulnerabilities