CVE-2025-21887 Overview
CVE-2025-21887 is a use-after-free vulnerability [CWE-416] in the Linux kernel's OverlayFS (overlayfs) subsystem. The flaw resides in the ovl_link_up function within fs/overlayfs/copy_up.c, where dput(upper) is called before ovl_dentry_update_reval() accesses the released dentry's d_flags field via ovl_dentry_remote(). A local authenticated user can trigger the freed memory access during file rename operations on an overlay filesystem, potentially leading to kernel memory corruption and local privilege escalation.
Critical Impact
Local attackers with low privileges can exploit the freed dentry access to corrupt kernel memory, causing denial of service or escalating privileges to root on affected Linux systems.
Affected Products
- Linux Kernel (multiple stable branches prior to the fix)
- Linux Kernel 6.14-rc1, 6.14-rc2, 6.14-rc3, 6.14-rc4
- Downstream distributions including Debian LTS and Siemens industrial products (per SSA-019113)
Discovery Timeline
- 2025-03-27 - CVE-2025-21887 published to the National Vulnerability Database
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2025-21887
Vulnerability Analysis
The vulnerability affects OverlayFS, the union filesystem used extensively by container runtimes and Linux distributions for layered storage. When a file rename triggers a copy-up operation, ovl_link_up() promotes a lower-layer dentry to the upper layer. The code path released the upper dentry reference through dput(upper) before completing subsequent metadata operations that still required access to it.
Specifically, ovl_dentry_update_reval() invokes ovl_dentry_remote() at fs/overlayfs/util.c:162, which reads upper->d_flags. Because the dentry had already been released, the read touched freed slab memory. KASAN reports confirmed a slab-use-after-free triggered through the call chain vfs_rename → ovl_rename → ovl_copy_up_flags → ovl_copy_up_one → ovl_link_up.
Root Cause
The root cause is incorrect object lifetime management. The dput() call decremented the dentry reference count and permitted its deallocation while a subsequent function still held a raw pointer to the object. The upstream fix moves dput(upper) to after the last use of the pointer, ensuring ovl_dentry_update_reval() operates on live memory.
Attack Vector
Exploitation requires local access and the ability to perform filesystem operations on an OverlayFS mount. An attacker crafts rename operations that trigger the vulnerable copy-up path. Winning the timing race between dput() and the subsequent dentry access allows the attacker to reclaim the freed slab object with attacker-controlled data. Successful exploitation can produce kernel memory corruption suitable for privilege escalation. Container escape scenarios are relevant given OverlayFS's role in Docker, Podman, and Kubernetes storage drivers.
No public proof-of-concept exploit is currently available. Technical details of the fix are documented in the Linux Kernel Commit f776182.
Detection Methods for CVE-2025-21887
Indicators of Compromise
- Kernel log entries containing KASAN: slab-use-after-free in ovl_dentry_remote or ovl_dentry_update_reval on debug kernels
- Unexpected kernel oops or panics originating from fs/overlayfs/copy_up.c or fs/overlayfs/util.c
- Unexplained privilege changes on user accounts operating within containerized workloads that use OverlayFS
Detection Strategies
- Inventory running kernels across the fleet and flag hosts running Linux 6.14-rc1 through 6.14-rc4 or unpatched stable branches referenced in the kernel.org advisories
- Enable and monitor auditd rules for rename operations on OverlayFS mounts by unprivileged users, particularly inside container workloads
- Correlate kernel crash dumps with the vulnerable call chain (ovl_rename → ovl_copy_up_one → ovl_link_up) to identify possible exploitation attempts
Monitoring Recommendations
- Ship kernel ring buffer (dmesg) and /var/log/kern.log to a centralized log platform and alert on OverlayFS-related oops signatures
- Monitor container runtime hosts for anomalous privilege escalation, unexpected root shells, or capability changes following heavy filesystem activity
- Track abnormal spikes in rename syscalls on overlay mounts as a behavioral signal of exploitation attempts
How to Mitigate CVE-2025-21887
Immediate Actions Required
- Apply the patched Linux kernel from your distribution vendor as soon as it is available for your release channel
- Prioritize patching container hosts, multi-tenant systems, and workloads exposing shell access to untrusted users
- Review the Debian LTS Announcement May 2025 and Siemens Security Advisory SSA-019113 for distribution-specific fixed versions
Patch Information
The upstream fix moves dput(upper) to after its last use in ovl_link_up, preventing the use-after-free in ovl_dentry_update_reval. Patched commits are available across stable branches, including Linux Kernel Commit 3594aad, Linux Kernel Commit 4b49d93, Linux Kernel Commit 60b4b5c, Linux Kernel Commit 64455c8, Linux Kernel Commit a7c4183, and Linux Kernel Commit c84e125.
Workarounds
- Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 on distributions that expose this sysctl, reducing exposure from unprivileged containers
- Avoid mounting OverlayFS filesystems accessible to untrusted local users until the patched kernel is deployed
- Where feasible, replace OverlayFS with an alternate storage driver on hosts that cannot be patched immediately
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
