GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21664 (GCVE-0-2025-21664)

Vulnerability from cvelistv5 – Published: 2025-01-21 12:18 – Updated: 2026-08-05 11:53
VLAI
Title
dm thin: make get_first_thin use rcu-safe list first function
Summary
In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty() -> list_first() sequence in RCU safe code. This is because each of these functions performs its own READ_ONCE() of the list head. This can lead to a situation where the list_empty() sees a valid list entry, but the subsequent list_first() sees a different view of list head state after a modification. In the case of dm-thin, this author had a production box crash from a GP fault in the process_deferred_bios path. This function saw a valid list head in get_first_thin() but when it subsequently dereferenced that and turned it into a thin_c, it got the inside of the struct pool, since the list was now empty and referring to itself. The kernel on which this occurred printed both a warning about a refcount_t being saturated, and a UBSAN error for an out-of-bounds cpuid access in the queued spinlock, prior to the fault itself. When the resulting kdump was examined, it was possible to see another thread patiently waiting in thin_dtr's synchronize_rcu. The thin_dtr call managed to pull the thin_c out of the active thins list (and have it be the last entry in the active_thins list) at just the wrong moment which lead to this crash. Fortunately, the fix here is straight forward. Switch get_first_thin() function to use list_first_or_null_rcu() which performs just a single READ_ONCE() and returns NULL if the list is already empty. This was run against the devicemapper test suite's thin-provisioning suites for delete and suspend and no regressions were observed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b10ebd34cccae1b431caf1be54919aede2be7cbe , < ec037fe8c0d0f6140e3d8a49c7b29cb5582160b8 (git)
Affected: b10ebd34cccae1b431caf1be54919aede2be7cbe , < cd30a3960433ec2db94b3689752fa3c5df44d649 (git)
Affected: b10ebd34cccae1b431caf1be54919aede2be7cbe , < 802666a40c71a23542c43a3f87e3a2d0f4e8fe45 (git)
Affected: b10ebd34cccae1b431caf1be54919aede2be7cbe , < 12771050b6d059eea096993bf2001da9da9fddff (git)
Affected: b10ebd34cccae1b431caf1be54919aede2be7cbe , < 6b305e98de0d225ccebfb225730a9f560d28ecb0 (git)
Affected: b10ebd34cccae1b431caf1be54919aede2be7cbe , < cbd0d5ecfa390ac29c5380200147d09c381b2ac6 (git)
Affected: b10ebd34cccae1b431caf1be54919aede2be7cbe , < 80f130bfad1dab93b95683fc39b87235682b8f72 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.15
Unaffected: 0 , < 3.15 (semver)
Unaffected: 5.4.290 , ≤ 5.4.* (semver)
Unaffected: 5.10.234 , ≤ 5.10.* (semver)
Unaffected: 5.15.177 , ≤ 5.15.* (semver)
Unaffected: 6.1.125 , ≤ 6.1.* (semver)
Unaffected: 6.6.72 , ≤ 6.6.* (semver)
Unaffected: 6.12.10 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:58:40.356Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:03:06.963Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-thin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ec037fe8c0d0f6140e3d8a49c7b29cb5582160b8",
              "status": "affected",
              "version": "b10ebd34cccae1b431caf1be54919aede2be7cbe",
              "versionType": "git"
            },
            {
              "lessThan": "cd30a3960433ec2db94b3689752fa3c5df44d649",
              "status": "affected",
              "version": "b10ebd34cccae1b431caf1be54919aede2be7cbe",
              "versionType": "git"
            },
            {
              "lessThan": "802666a40c71a23542c43a3f87e3a2d0f4e8fe45",
              "status": "affected",
              "version": "b10ebd34cccae1b431caf1be54919aede2be7cbe",
              "versionType": "git"
            },
            {
              "lessThan": "12771050b6d059eea096993bf2001da9da9fddff",
              "status": "affected",
              "version": "b10ebd34cccae1b431caf1be54919aede2be7cbe",
              "versionType": "git"
            },
            {
              "lessThan": "6b305e98de0d225ccebfb225730a9f560d28ecb0",
              "status": "affected",
              "version": "b10ebd34cccae1b431caf1be54919aede2be7cbe",
              "versionType": "git"
            },
            {
              "lessThan": "cbd0d5ecfa390ac29c5380200147d09c381b2ac6",
              "status": "affected",
              "version": "b10ebd34cccae1b431caf1be54919aede2be7cbe",
              "versionType": "git"
            },
            {
              "lessThan": "80f130bfad1dab93b95683fc39b87235682b8f72",
              "status": "affected",
              "version": "b10ebd34cccae1b431caf1be54919aede2be7cbe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-thin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.290",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.234",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.290",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.234",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.177",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.125",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: make get_first_thin use rcu-safe list first function\n\nThe documentation in rculist.h explains the absence of list_empty_rcu()\nand cautions programmers against relying on a list_empty() -\u003e\nlist_first() sequence in RCU safe code.  This is because each of these\nfunctions performs its own READ_ONCE() of the list head.  This can lead\nto a situation where the list_empty() sees a valid list entry, but the\nsubsequent list_first() sees a different view of list head state after a\nmodification.\n\nIn the case of dm-thin, this author had a production box crash from a GP\nfault in the process_deferred_bios path.  This function saw a valid list\nhead in get_first_thin() but when it subsequently dereferenced that and\nturned it into a thin_c, it got the inside of the struct pool, since the\nlist was now empty and referring to itself.  The kernel on which this\noccurred printed both a warning about a refcount_t being saturated, and\na UBSAN error for an out-of-bounds cpuid access in the queued spinlock,\nprior to the fault itself.  When the resulting kdump was examined, it\nwas possible to see another thread patiently waiting in thin_dtr\u0027s\nsynchronize_rcu.\n\nThe thin_dtr call managed to pull the thin_c out of the active thins\nlist (and have it be the last entry in the active_thins list) at just\nthe wrong moment which lead to this crash.\n\nFortunately, the fix here is straight forward.  Switch get_first_thin()\nfunction to use list_first_or_null_rcu() which performs just a single\nREAD_ONCE() and returns NULL if the list is already empty.\n\nThis was run against the devicemapper test suite\u0027s thin-provisioning\nsuites for delete and suspend and no regressions were observed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the dm-thin pool worker, reached via block I/O to a thin device and via DM device teardown \u2014 both require local access to the machine (device file / ioctl), with no network-facing path.\nAC:L - The attacker drives one side of the race continuously (unbounded I/O to the thin device keeps process_deferred_bios re-running) and the removal side is repeatable in a loop, so attempts are unlimited; the commit reports the race firing spontaneously on a production box with no attacker at all.\nPR:L - An unprivileged user with access to a thin volume (container guest, dm device with group/ACL access) supplies the malicious half of the race by flooding deferred bios, while the thin-device teardown is routine automation on LVM-thin/container-storage hosts; with deferred remove armed, an unprivileged holder of the device even triggers thin_dtr directly via close().\nUI:N - No victim action is required \u2014 thin volume teardown happens automatically under LVM/container orchestration, and the pool worker runs on its own periodic waker plus attacker-generated I/O.\nS:U - The corruption is confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The type confusion makes the worker treat a kernel text address as a struct pool and read through it, and the garbage qspinlock value causes out-of-bounds per-CPU array indexing (the reported UBSAN OOB access), giving wild out-of-bounds reads that can be leveraged for disclosure.\nI:H - The bogus thin_c overlays struct pool\u0027s function-pointer tail, so refcount_inc() and spin_lock_irq() write over live function pointers and list_splice_init() writes through wild list heads \u2014 memory corruption of indirect-call targets that is exploitable for control-flow hijack.\nA:H - The bug produced a confirmed general-protection fault in process_deferred_bios on a production system, panicking the kernel and taking down all storage served by the thin pool."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:29.038Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ec037fe8c0d0f6140e3d8a49c7b29cb5582160b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd30a3960433ec2db94b3689752fa3c5df44d649"
        },
        {
          "url": "https://git.kernel.org/stable/c/802666a40c71a23542c43a3f87e3a2d0f4e8fe45"
        },
        {
          "url": "https://git.kernel.org/stable/c/12771050b6d059eea096993bf2001da9da9fddff"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b305e98de0d225ccebfb225730a9f560d28ecb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbd0d5ecfa390ac29c5380200147d09c381b2ac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/80f130bfad1dab93b95683fc39b87235682b8f72"
        }
      ],
      "title": "dm thin: make get_first_thin use rcu-safe list first function",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21664",
    "datePublished": "2025-01-21T12:18:19.015Z",
    "dateReserved": "2024-12-29T08:45:45.732Z",
    "dateUpdated": "2026-08-05T11:53:29.038Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21664",
      "date": "2026-09-16",
      "epss": "0.00236",
      "percentile": "0.1471"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21664\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-21T13:15:10.053\",\"lastModified\":\"2026-07-30T06:18:05.070\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndm thin: make get_first_thin use rcu-safe list first function\\n\\nThe documentation in rculist.h explains the absence of list_empty_rcu()\\nand cautions programmers against relying on a list_empty() -\u003e\\nlist_first() sequence in RCU safe code.  This is because each of these\\nfunctions performs its own READ_ONCE() of the list head.  This can lead\\nto a situation where the list_empty() sees a valid list entry, but the\\nsubsequent list_first() sees a different view of list head state after a\\nmodification.\\n\\nIn the case of dm-thin, this author had a production box crash from a GP\\nfault in the process_deferred_bios path.  This function saw a valid list\\nhead in get_first_thin() but when it subsequently dereferenced that and\\nturned it into a thin_c, it got the inside of the struct pool, since the\\nlist was now empty and referring to itself.  The kernel on which this\\noccurred printed both a warning about a refcount_t being saturated, and\\na UBSAN error for an out-of-bounds cpuid access in the queued spinlock,\\nprior to the fault itself.  When the resulting kdump was examined, it\\nwas possible to see another thread patiently waiting in thin_dtr\u0027s\\nsynchronize_rcu.\\n\\nThe thin_dtr call managed to pull the thin_c out of the active thins\\nlist (and have it be the last entry in the active_thins list) at just\\nthe wrong moment which lead to this crash.\\n\\nFortunately, the fix here is straight forward.  Switch get_first_thin()\\nfunction to use list_first_or_null_rcu() which performs just a single\\nREAD_ONCE() and returns NULL if the list is already empty.\\n\\nThis was run against the devicemapper test suite\u0027s thin-provisioning\\nsuites for delete and suspend and no regressions were observed.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm thin: hacer que get_first_thin use la funci\u00f3n list first de rcu-safe La documentaci\u00f3n en rculist.h explica la ausencia de list_empty_rcu() y advierte a los programadores que no conf\u00eden en una secuencia list_empty() -\u0026gt; list_first() en el c\u00f3digo seguro de RCU. Esto se debe a que cada una de estas funciones realiza su propio READ_ONCE() del encabezado de la lista. Esto puede llevar a una situaci\u00f3n en la que list_empty() ve una entrada de lista v\u00e1lida, pero el list_first() posterior ve una vista diferente del estado del encabezado de lista despu\u00e9s de una modificaci\u00f3n. En el caso de dm-thin, este autor tuvo un bloqueo del cuadro de producci\u00f3n debido a una falla de GP en la ruta process_deferred_bios. Esta funci\u00f3n vio un encabezado de lista v\u00e1lido en get_first_thin() pero cuando posteriormente desreferenciaba eso y lo convert\u00eda en un thin_c, obtuvo el interior del grupo de estructuras, ya que la lista ahora estaba vac\u00eda y se refer\u00eda a s\u00ed misma. El n\u00facleo en el que esto ocurri\u00f3 imprimi\u00f3 una advertencia sobre la saturaci\u00f3n de un refcount_t y un error UBSAN por un acceso a cpuid fuera de los l\u00edmites en el spinlock en cola, antes del fallo en s\u00ed. Cuando se examin\u00f3 el kdump resultante, fue posible ver otro hilo esperando pacientemente en elsynchronous_rcu de thin_dtr. La llamada thin_dtr logr\u00f3 sacar el thin_c de la lista de thins activa (y hacer que sea la \u00faltima entrada en la lista de active_thins) justo en el momento equivocado, lo que provoc\u00f3 este bloqueo. Afortunadamente, la soluci\u00f3n aqu\u00ed es sencilla. Cambie la funci\u00f3n get_first_thin() para usar list_first_or_null_rcu() que realiza solo un \u00fanico READ_ONCE() y devuelve NULL si la lista ya est\u00e1 vac\u00eda. Esto se ejecut\u00f3 contra las suites de aprovisionamiento fino del conjunto de pruebas devicemapper para eliminar y suspender y no se observaron regresiones.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/dm-thin.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\"lessThan\":\"ec037fe8c0d0f6140e3d8a49c7b29cb5582160b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\"lessThan\":\"cd30a3960433ec2db94b3689752fa3c5df44d649\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\"lessThan\":\"802666a40c71a23542c43a3f87e3a2d0f4e8fe45\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\"lessThan\":\"12771050b6d059eea096993bf2001da9da9fddff\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\"lessThan\":\"6b305e98de0d225ccebfb225730a9f560d28ecb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\"lessThan\":\"cbd0d5ecfa390ac29c5380200147d09c381b2ac6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b10ebd34cccae1b431caf1be54919aede2be7cbe\",\"lessThan\":\"80f130bfad1dab93b95683fc39b87235682b8f72\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/dm-thin.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.290\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.234\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.177\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.125\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.72\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.10\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.15.1\",\"versionEndExcluding\":\"5.4.290\",\"matchCriteriaId\":\"06E3D8A0-2ABD-417B-B56D-AA20015A3FEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.234\",\"matchCriteriaId\":\"F732162B-ED7E-4367-A5C2-B24FD9B0D33B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.177\",\"matchCriteriaId\":\"71A3AFDC-A3CA-454F-8917-E998BBDE36F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.125\",\"matchCriteriaId\":\"9AFD566B-ECC6-46F1-92F7-12A615D5685F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.72\",\"matchCriteriaId\":\"33E12097-C88A-45B4-9677-2A961A08DD3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"02D604F6-10D1-4F7B-A022-0888406A1121\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.15:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F138B0D1-8A71-47E3-B203-17061370DFD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"65A165BE-BAC4-4DC6-A333-72A486481AD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E897136-35E2-48BC-BF4F-2160B2A00D69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"6598CE29-AAD6-4FD9-B662-6AEE6812A8E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.15:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C02C163F-D1BD-4284-B652-AFB5EAFE9879\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.15:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"D28A725C-B7B8-4634-8C5C-FC56439B51AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12771050b6d059eea096993bf2001da9da9fddff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b305e98de0d225ccebfb225730a9f560d28ecb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/802666a40c71a23542c43a3f87e3a2d0f4e8fe45\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/80f130bfad1dab93b95683fc39b87235682b8f72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cbd0d5ecfa390ac29c5380200147d09c381b2ac6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cd30a3960433ec2db94b3689752fa3c5df44d649\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec037fe8c0d0f6140e3d8a49c7b29cb5582160b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:41:14+00:00",
      "cve": "CVE-2025-21664",
      "id": "CVE-2025-21664",
      "initial_release_date": "2025-01-21T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm thin: make get_first_thin use rcu-safe list first function",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21664.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:03:25Z",
      "cve": "CVE-2025-21664",
      "id": "CVE-2025-21664",
      "initial_release_date": "2025-01-22T03:48:17Z",
      "product_status:known_affected": "761",
      "product_status:known_not_affected": "38",
      "product_status:recommended": "398",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21664",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21664.json",
      "version": "69"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.