CVE-2025-21811

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: protect access to buffers with no active references

nilfs_lookup_dirty_data_buffers(), which iterates through the buffers attached to dirty data folios/pages, accesses the attached buffers without locking the folios/pages.

For data cache, nilfs_clear_folio_dirty() may be called asynchronously when the file system degenerates to read only, so nilfs_lookup_dirty_data_buffers() still has the potential to cause use after free issues when buffers lose the protection of their dirty state midway due to this asynchronous clearing and are unintentionally freed by try_to_free_buffers().

Eliminate this race issue by adjusting the lock section in this function.

This vulnerability is rated as an Important severity flaw because a local unprivileged attacker could leverage a race condition during dirty buffer lookups to trigger a use-after-free condition, potentially compromising kernel memory integrity or executing arbitrary code. While the upstream flaw carries high impact due to kernel-level privileges, default Red Hat Enterprise Linux installations are not affected because the NILFS2 file system driver is not enabled or compiled in supported enterprise kernels. Exploitation requires an active NILFS2 mount, which is not supported out of the box in standard Red Hat environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.