CVE-2025-21664

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

dm thin: make get_first_thin use rcu-safe list first function

The documentation in rculist.h explains the absence of list_empty_rcu()

and cautions programmers against relying on a list_empty() ->

list_first() sequence in RCU safe code. This is because each of these

functions performs its own READ_ONCE() of the list head. This can lead

to a situation where the list_empty() sees a valid list entry, but the

subsequent list_first() sees a different view of list head state after a

modification.

In the case of dm-thin, this author had a production box crash from a GP

fault in the process_deferred_bios path. This function saw a valid list

head in get_first_thin() but when it subsequently dereferenced that and

turned it into a thin_c, it got the inside of the struct pool, since the

list was now empty and referring to itself. The kernel on which this

occurred printed both a warning about a refcount_t being saturated, and

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References