CVE-2025-21722 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2025-21722?

CVE-2025-21722 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's nilfs2 filesystem driver allows local attackers to potentially crash the system or execute arbitrary code. This occurs when the filesystem detects corruption and falls back to read-only mode, causing buffer state inconsistencies. Systems using the nilfs2 filesystem are affected.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's nilfs2 filesystem driver allows local attackers to potentially crash the system or execute arbitrary code. This occurs when the filesystem detects corruption and falls back to read-only mode, causing buffer state inconsistencies. Systems using the nilfs2 filesystem are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches available for stable kernel branches.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if nilfs2 filesystem is mounted. Most systems don't use nilfs2 by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, leading to complete system compromise.

🟠

Likely Case

Kernel panic or system crash causing denial of service.

🟢

If Mitigated

Limited impact if nilfs2 filesystem is not mounted or SELinux/AppArmor restricts access.

🌐 Internet-Facing: LOW - This is a local filesystem vulnerability requiring local access.

🏢 Internal Only: MEDIUM - Internal users with shell access could exploit this to crash systems or potentially escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger nilfs2 corruption detection. No public exploits known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel branches (commits: 1098bb8d52419d262a3358d099a1598a920b730f, 19296737024cd220a1d6590bf4c092bca8c99497, etc.)

Vendor Advisory: https://git.kernel.org/stable/c/1098bb8d52419d262a3358d099a1598a920b730f

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable nilfs2 mounting

Linux

Prevent nilfs2 filesystem from being mounted to eliminate attack surface.

echo 'install nilfs2 /bin/true' >> /etc/modprobe.d/disable-nilfs2.conf
rmmod nilfs2 2>/dev/null || true

🧯 If You Can't Patch

Ensure nilfs2 filesystem is not mounted on any system partitions.
Implement strict access controls to limit who can mount filesystems or trigger filesystem operations.

🔍 How to Verify

Check if Vulnerable:

Check if nilfs2 module is loaded: lsmod | grep nilfs2. Check kernel version against patched releases.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes patched commits. Check /proc/version or uname -r against distribution security updates.

📡 Detection & Monitoring

Log Indicators:

Kernel warnings about 'mark_buffer_dirty' or 'nilfs_btree_propagate'
System crashes or kernel panics when using nilfs2
Read-only fallback messages for nilfs2 filesystem

Network Indicators:

None - this is a local filesystem vulnerability

SIEM Query:

source="kernel" AND ("mark_buffer_dirty" OR "nilfs_btree_propagate" OR "nilfs2")

📊 Metadata

CVE ID: CVE-2025-21722

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.04% exploit probability (12.3th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-21722, you might also want to check these: