APPLIED: [SRU][N][PATCH 0/1] CVE-2025-21887

[Mehmet Basaran]

Applied to noble:linux master-next branch. Thanks.

-------------- next part --------------
Manuel Diewald <manuel.diewald at canonical.com> writes:

> https://ubuntu.com/security/CVE-2025-21887
>
> SRU Justification:
>
> [Impact]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
>
> The issue was caused by dput(upper) being called before
> ovl_dentry_update_reval(), while upper->d_flags was still accessed in
> ovl_dentry_remote(). Move dput(upper) after its last use to prevent
> use-after-free.
>
> [Fix]
>
> Plucky: Not affected
> Noble:  Clean cherry-pick from mainline
> Jammy:  Fixed with upstream stable update v5.15.179 (LP: #2106026)
> Focal:  Not affected
> Bionic: Not affected
> Xenial: Not affected
> Trusty: Not affected
>
> [Test Plan]
>
> Compile-tested only.
>
> [Where problems could occur]
>
> Problems with the patch would be limited to overlayfs and manifest as
> unexpected behavior involving files.
>
>
> Vasiliy Kovalev (1):
>   ovl: fix UAF in ovl_dentry_update_reval by moving dput() in
>     ovl_link_up
>
>  fs/overlayfs/copy_up.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> -- 
> 2.34.1
>
>
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 873 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20250807/5223aed1/attachment.sig>