CVE-2025-21811 Overview
CVE-2025-21811 is a use-after-free vulnerability in the Linux kernel's nilfs2 filesystem implementation. The flaw resides in nilfs_lookup_dirty_data_buffers(), which iterates buffers attached to dirty data folios/pages without holding the folio or page lock. When the filesystem degenerates to read-only, nilfs_clear_folio_dirty() may run asynchronously, allowing try_to_free_buffers() to release buffers that other code paths still reference. A local attacker with the ability to trigger nilfs2 I/O activity can exploit the race to corrupt kernel memory. The issue is tracked as [CWE-416] and was resolved upstream by adjusting the locking section in the affected function.
Critical Impact
Local exploitation of this use-after-free can lead to kernel memory corruption, privilege escalation, or system compromise on hosts using the nilfs2 filesystem.
Affected Products
- Linux Kernel (multiple stable branches prior to the fix commits)
- Debian distributions using vulnerable kernels (see Debian LTS Advisory March 2025)
- Debian distributions using vulnerable kernels (see Debian LTS Advisory May 2025)
Discovery Timeline
- 2025-02-27 - CVE-2025-21811 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21811
Vulnerability Analysis
The nilfs2 filesystem tracks dirty data through buffers attached to folios and pages. The function nilfs_lookup_dirty_data_buffers() walks these buffer chains to identify dirty data that must be written back during segment construction. The original implementation accessed attached buffers without taking the folio or page lock that normally serializes buffer lifetime management.
When nilfs2 transitions to read-only mode after an I/O error or corruption event, nilfs_clear_folio_dirty() executes asynchronously. This clears the dirty state that keeps buffers pinned. Once the dirty flag is dropped, try_to_free_buffers() becomes eligible to reclaim the underlying buffer_head structures. A concurrent iteration in nilfs_lookup_dirty_data_buffers() can then dereference freed memory, satisfying the classic use-after-free pattern.
Root Cause
The root cause is missing folio/page-level locking around buffer chain traversal. The dirty state alone is insufficient to guarantee buffer lifetime once asynchronous read-only degradation is possible. Without holding the folio lock, the iteration racing against try_to_free_buffers() accesses buffers whose reference guarantees have already been invalidated.
Attack Vector
Exploitation requires local access with the ability to interact with a mounted nilfs2 volume. An attacker triggers filesystem activity that forces the volume into read-only mode while segment construction is in progress. Winning the race against nilfs_clear_folio_dirty() and try_to_free_buffers() produces a dangling buffer_head pointer that kernel code subsequently dereferences. The vulnerability manifests without network access or user interaction. Refer to the upstream fix commits such as Kernel Patch 8e1b920 for the exact locking adjustment.
Detection Methods for CVE-2025-21811
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing nilfs_lookup_dirty_data_buffers, try_to_free_buffers, or nilfs_clear_folio_dirty in dmesg and /var/log/kern.log.
- nilfs2 filesystems transitioning to read-only unexpectedly, followed by process crashes or memory corruption symptoms.
- KASAN reports flagging use-after-free access to buffer_head structures on kernels built with sanitizer support.
Detection Strategies
- Inventory hosts with the nilfs2 kernel module loaded using lsmod | grep nilfs2 and identify systems mounting nilfs2 volumes via /proc/mounts.
- Compare running kernel versions against the fixed commits listed in the kernel.org stable trees to identify unpatched builds.
- Monitor for repeated nilfs2-related kernel warnings that may indicate exploitation attempts against the race window.
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on nilfs2 error strings and buffer subsystem panics.
- Track kernel package inventory across the fleet to confirm patch deployment on Debian, Ubuntu, and other affected distributions.
- Baseline expected nilfs2 usage; investigate hosts that mount nilfs2 outside of documented workloads.
How to Mitigate CVE-2025-21811
Immediate Actions Required
- Apply the latest stable kernel updates from your distribution vendor that include the upstream nilfs2 locking fix.
- Restrict local shell access on multi-user systems until patches are deployed, since the attack requires local privileges.
- Unmount nilfs2 volumes and unload the nilfs2 module on systems that do not require the filesystem.
Patch Information
The upstream fix adjusts the lock section in nilfs_lookup_dirty_data_buffers() so that buffer chain iteration is protected against asynchronous dirty clearing. Fix commits are available across stable branches, including Kernel Patch 367a9bf, Kernel Patch 4b08d23, Kernel Patch 58c27fa, Kernel Patch 72cf688, Kernel Patch c437dfa, Kernel Patch d8ff250, and Kernel Patch e1fc4a9. Debian users should install updated packages per the Debian LTS Advisory March 2025 and Debian LTS Advisory May 2025.
Workarounds
- Blocklist the nilfs2 module via /etc/modprobe.d/ to prevent loading on hosts that do not need it.
- Avoid mounting untrusted or user-controlled nilfs2 images, and disable automatic filesystem probing on removable media.
- Enforce least-privilege access controls to reduce the pool of local users capable of triggering nilfs2 operations.
# Prevent nilfs2 from loading on hosts that do not require it
echo 'install nilfs2 /bin/true' | sudo tee /etc/modprobe.d/disable-nilfs2.conf
sudo update-initramfs -u
# Verify the module is not currently loaded
lsmod | grep nilfs2
# Confirm no nilfs2 volumes are mounted
grep nilfs2 /proc/mounts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
