CVE-2025-21643

A flaw was found in the Linux kernel's netfs subsystem. A local user can cause a Denial of Service (DoS) condition by triggering kernel-initiated asynchronous Direct I/O (DIO) operations on affected network filesystems. Because the subsystem misinterprets internal kernel write requests as userspace operations, iterator extraction fails, resulting in kernel warnings and failed write requests.

This vulnerability is rated as having a Low impact because it requires an atypical local storage configuration and results only in kernel warning logs and rejected write operations rather than a system crash or privilege escalation. Typical Red Hat Enterprise Linux deployments do not stack direct I/O loopback block devices over network filesystems such as CIFS. Furthermore, establishing the prerequisite storage setup requires administrative privileges, significantly constraining practical exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.