CVE-2025-21643 (GCVE-0-2025-21643)

Vulnerability from cvelistv5 – Published: 2025-01-19 10:17 – Updated: 2026-05-11 21:03
VLAI
Title
netfs: Fix kernel async DIO
Summary
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix kernel async DIO Netfslib needs to be able to handle kernel-initiated asynchronous DIO that is supplied with a bio_vec[] array. Currently, because of the async flag, this gets passed to netfs_extract_user_iter() which throws a warning and fails because it only handles IOVEC and UBUF iterators. This can be triggered through a combination of cifs and a loopback blockdev with something like: mount //my/cifs/share /foo dd if=/dev/zero of=/foo/m0 bs=4K count=1K losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0 echo hello >/dev/loop2046 This causes the following to appear in syslog: WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs] and the write to fail. Fix this by removing the check in netfs_unbuffered_write_iter_locked() that causes async kernel DIO writes to be handled as userspace writes. Note that this change relies on the kernel caller maintaining the existence of the bio_vec array (or kvec[] or folio_queue) until the op is complete.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 153a9961b551101cd38e94e26cd92fbfd198b19b , < 9f3a265836844eda30bf34c2584b8011fd4f0f49 (git)
Affected: 153a9961b551101cd38e94e26cd92fbfd198b19b , < 3f6bc9e3ab9b127171d39f9ac6eca1abb693b731 (git)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.10 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/direct_write.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9f3a265836844eda30bf34c2584b8011fd4f0f49",
              "status": "affected",
              "version": "153a9961b551101cd38e94e26cd92fbfd198b19b",
              "versionType": "git"
            },
            {
              "lessThan": "3f6bc9e3ab9b127171d39f9ac6eca1abb693b731",
              "status": "affected",
              "version": "153a9961b551101cd38e94e26cd92fbfd198b19b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/direct_write.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix kernel async DIO\n\nNetfslib needs to be able to handle kernel-initiated asynchronous DIO that\nis supplied with a bio_vec[] array.  Currently, because of the async flag,\nthis gets passed to netfs_extract_user_iter() which throws a warning and\nfails because it only handles IOVEC and UBUF iterators.  This can be\ntriggered through a combination of cifs and a loopback blockdev with\nsomething like:\n\n        mount //my/cifs/share /foo\n        dd if=/dev/zero of=/foo/m0 bs=4K count=1K\n        losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0\n        echo hello \u003e/dev/loop2046\n\nThis causes the following to appear in syslog:\n\n        WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs]\n\nand the write to fail.\n\nFix this by removing the check in netfs_unbuffered_write_iter_locked() that\ncauses async kernel DIO writes to be handled as userspace writes.  Note\nthat this change relies on the kernel caller maintaining the existence of\nthe bio_vec array (or kvec[] or folio_queue) until the op is complete."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:03:38.878Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9f3a265836844eda30bf34c2584b8011fd4f0f49"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f6bc9e3ab9b127171d39f9ac6eca1abb693b731"
        }
      ],
      "title": "netfs: Fix kernel async DIO",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21643",
    "datePublished": "2025-01-19T10:17:59.820Z",
    "dateReserved": "2024-12-29T08:45:45.727Z",
    "dateUpdated": "2026-05-11T21:03:38.878Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21643",
      "date": "2026-07-15",
      "epss": "0.00209",
      "percentile": "0.11088"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21643\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T11:15:09.870\",\"lastModified\":\"2026-06-17T08:43:55.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfs: Fix kernel async DIO\\n\\nNetfslib needs to be able to handle kernel-initiated asynchronous DIO that\\nis supplied with a bio_vec[] array.  Currently, because of the async flag,\\nthis gets passed to netfs_extract_user_iter() which throws a warning and\\nfails because it only handles IOVEC and UBUF iterators.  This can be\\ntriggered through a combination of cifs and a loopback blockdev with\\nsomething like:\\n\\n        mount //my/cifs/share /foo\\n        dd if=/dev/zero of=/foo/m0 bs=4K count=1K\\n        losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0\\n        echo hello \u003e/dev/loop2046\\n\\nThis causes the following to appear in syslog:\\n\\n        WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs]\\n\\nand the write to fail.\\n\\nFix this by removing the check in netfs_unbuffered_write_iter_locked() that\\ncauses async kernel DIO writes to be handled as userspace writes.  Note\\nthat this change relies on the kernel caller maintaining the existence of\\nthe bio_vec array (or kvec[] or folio_queue) until the op is complete.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfs: Se corrige el error DIO asincr\u00f3nico del kernel Netfslib debe poder gestionar el error DIO asincr\u00f3nico iniciado por el kernel que se suministra con una matriz bio_vec[]. Actualmente, debido al indicador async, esto se pasa a netfs_extract_user_iter() que lanza una advertencia y falla porque solo gestiona iteradores IOVEC y UBUF. Esto se puede activar a trav\u00e9s de una combinaci\u00f3n de cifs y un blockdev de bucle invertido con algo como: mount //my/cifs/share /foo dd if=/dev/zero of=/foo/m0 bs=4K count=1K losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0 echo hello \u0026gt;/dev/loop2046 Esto hace que aparezca lo siguiente en syslog: ADVERTENCIA: CPU: 2 PID: 109 en fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs] y que la escritura falle. Solucione esto eliminando la comprobaci\u00f3n en netfs_unbuffered_write_iter_locked() que hace que las escrituras DIO del kernel as\u00edncronas se gestionen como escrituras del espacio de usuario. Tenga en cuenta que este cambio depende de que el llamador del n\u00facleo mantenga la existencia de la matriz bio_vec (o kvec[] o folio_queue) hasta que se complete la operaci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/netfs/direct_write.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"153a9961b551101cd38e94e26cd92fbfd198b19b\",\"lessThan\":\"9f3a265836844eda30bf34c2584b8011fd4f0f49\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"153a9961b551101cd38e94e26cd92fbfd198b19b\",\"lessThan\":\"3f6bc9e3ab9b127171d39f9ac6eca1abb693b731\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/netfs/direct_write.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.10\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"9456486B-ABA1-4DFF-B398-A54A1640A72E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3f6bc9e3ab9b127171d39f9ac6eca1abb693b731\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9f3a265836844eda30bf34c2584b8011fd4f0f49\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T10:37:39+00:00",
      "cve": "CVE-2025-21643",
      "id": "CVE-2025-21643",
      "initial_release_date": "2025-01-19T00:00:00+00:00",
      "product_status:known_affected": "78",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfs: Fix kernel async DIO",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21643.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.