{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-21887",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-21887",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-03-27T14:57:14.524Z",
    "updatedAt": "2026-10-15T01:05:05.402Z",
    "importedAt": "2026-10-24T01:57:29.455Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up\n\nThe issue was caused by dput(upper) being called before\novl_dentry_update_reval(), while upper->d_flags was still\naccessed in ovl_dentry_remote().\n\nMove dput(upper) after its last use to prevent use-after-free.\n\nBUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\nBUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0xc3/0x620 mm/kasan/report.c:488\n kasan_report+0xd9/0x110 mm/kasan/report.c:601\n ovl_dentry_remote fs/overlayfs/util.c:162 [inline]\n ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167\n ovl_link_up fs/overlayfs/copy_up.c:610 [inline]\n ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170\n ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223\n ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136\n vfs_rename+0xf84/0x20a0 fs/namei.c:4893\n...\n </TASK>",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "714ba10a6dd19752a349e59aa875f3288ccb59b9",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f77618291836168eca99e89cd175256f928f5e64"
            },
            {
              "version": "62f29ca45f832e281fc14966ac25f6ff3bd121ca",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4b49d939b5a79117f939b77cc67efae2694d9799"
            },
            {
              "version": "e4f2a1feebb3f209a0fca82aa53507a5b8be4d53",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a7c41830ffcd17b2177a95a9b99b270302090c35"
            },
            {
              "version": "b07d5cc93e1b28df47a72c519d09d0a836043613",
              "status": "affected",
              "versionType": "git",
              "lessThan": "64455c8051c3aedc71abb7ec8d47c80301f99f00"
            },
            {
              "version": "b07d5cc93e1b28df47a72c519d09d0a836043613",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3594aad97e7be2557ca9fa9c931b206b604028c8"
            },
            {
              "version": "b07d5cc93e1b28df47a72c519d09d0a836043613",
              "status": "affected",
              "versionType": "git",
              "lessThan": "60b4b5c1277fc491da9e1e7abab307bfa39c2db7"
            },
            {
              "version": "b07d5cc93e1b28df47a72c519d09d0a836043613",
              "status": "affected",
              "versionType": "git",
              "lessThan": "c84e125fff2615b4d9c259e762596134eddd2f27"
            },
            {
              "version": "33ab4dd6202f359558a0a2678b94d1b9994c17e5",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "1ecdc55e5cd9f70f8d7513802971d4cffb9f77af",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "5.10.188",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.10.247"
            },
            {
              "version": "5.15.121",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.15.179"
            },
            {
              "version": "6.1.39",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.1.130"
            },
            {
              "version": "6.3.13",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.4"
            },
            {
              "version": "6.4.4",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.5"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.5",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.5"
            },
            {
              "version": "5.10.247",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.179",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.130",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.81",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.18",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.13.6",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.13.*"
            },
            {
              "version": "6.14",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}