CVE-2025-21722: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21722 Overview

CVE-2025-21722 is a use-after-free vulnerability [CWE-416] in the Linux kernel's nilfs2 filesystem. The flaw occurs when nilfs2 detects filesystem corruption and falls back to read-only mode. Callbacks handling page and folio write requests forcibly clear buffer states, including those still referenced by active operations. This produces buffer head state inconsistencies and a use-after-free condition that can be triggered by a local attacker with mounted nilfs2 media. Syzbot discovered and reported the underlying issue during automated kernel fuzzing.

Critical Impact
Local attackers can trigger kernel memory corruption through crafted or corrupted nilfs2 filesystem images, leading to denial of service or potential privilege escalation on affected Linux systems.

Affected Products

Linux Kernel — multiple stable branches prior to the fix commits
Debian LTS distributions shipping vulnerable nilfs2 module
Any Linux distribution using kernels before the referenced stable patches

Discovery Timeline

2025-02-27 - CVE-2025-21722 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21722

Vulnerability Analysis

The vulnerability resides in the nilfs2 (New Implementation of a Log-structured File System) subsystem within fs/nilfs2/. When the filesystem encounters corruption, it triggers a read-only fallback path. During this transition, page and folio write completion callbacks aggressively clear buffer head state without verifying whether those buffers are still referenced by other kernel components.

Two observable symptoms confirm the inconsistent state. First, mark_buffer_dirty() in fs/buffer.c:1177 raises a warning when nilfs_palloc_commit_alloc_entry() operates on a buffer that is no longer marked uptodate. Second, nilfs_btree_propagate() in fs/nilfs2/btree.c:2089 detects that the origin buffer is not dirty when propagating b-tree ancestor updates. Both conditions arise because busy buffer heads were force-cleared while still in use, creating dangling references that lead to use-after-free access.

Root Cause

The root cause is missing validation of buffer reference counts before clearing folio and page state during read-only fallback. The write completion callbacks assumed that buffers associated with a folio could be safely reset, ignoring cases where higher-level nilfs2 operations still held active references. This violates the buffer head lifecycle contract and produces classic use-after-free semantics [CWE-416].

Attack Vector

Exploitation requires local access with the ability to mount or interact with a nilfs2 filesystem image. An attacker crafts a corrupted nilfs2 image and mounts it, forcing the filesystem into read-only fallback while file operations remain in flight. The resulting buffer head inconsistency can be leveraged to corrupt kernel memory. The CVSS vector indicates local attack with low privileges required and no user interaction, with high impact to confidentiality, integrity, and availability.

See the Linux kernel patch commit for technical implementation details of the fix. The patch adds a reference check before clearing folio state and skips the clear if the buffer is still referenced.

Detection Methods for CVE-2025-21722

Indicators of Compromise

Kernel warning traces from mark_buffer_dirty+0x2e5/0x520 in fs/buffer.c:1177
Kernel warning traces from nilfs_btree_propagate+0xc79/0xdf0 in fs/nilfs2/btree.c:2089
Unexpected nilfs2 read-only remount events in dmesg following mount of untrusted media
Kernel oops or panic entries referencing nilfs_palloc_commit_alloc_entry or nilfs_bmap_propagate

Detection Strategies

Monitor kernel logs for WARNING messages originating in fs/nilfs2/ call paths
Audit systems for the presence and use of the nilfs2 kernel module using lsmod | grep nilfs2
Correlate mount events for nilfs2 filesystems with subsequent kernel warnings within a short time window
Track running kernel versions against the fixed commits published on git.kernel.org

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into centralized logging for nilfs2-related warnings
Alert on any user-initiated mount of nilfs2 images from removable media or user-controlled paths
Track mount syscall telemetry with a type=nilfs2 filter on multi-user systems

How to Mitigate CVE-2025-21722

Immediate Actions Required

Apply the stable kernel updates referenced by the upstream commits, including 1098bb8d5241, 19296737024c, 4d042811c72f, 557ccf5e49f1, 7d0544bacc11, ca76bb226bf4, and f51ff43c4c5a
Install the Debian security updates from the Debian LTS March 2025 announcement and the Debian LTS May 2025 announcement
Blocklist the nilfs2 kernel module on systems that do not require it
Restrict mount permissions for removable and user-supplied filesystem images

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Consult the Linux Kernel Commit index for the mainline fix. Distributions including Debian have published patched kernel packages via their standard security update channels.

Workarounds

Prevent module loading by adding install nilfs2 /bin/true to /etc/modprobe.d/blacklist-nilfs2.conf on systems that do not use nilfs2
Disable automatic mounting of removable media through udisks2 policy or desktop environment settings
Restrict use of the mount command to trusted administrators via sudoers policy
Enforce that only trusted filesystem images are mounted, ideally with nosuid,nodev,noexec mount options

bash

# Blacklist the vulnerable nilfs2 module until patching is complete
echo "install nilfs2 /bin/true" | sudo tee /etc/modprobe.d/blacklist-nilfs2.conf
sudo rmmod nilfs2 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep nilfs2

# Confirm running kernel version against fixed stable releases
uname -r