CVE-2025-21679 — Incorrect Check of Function Return Value in Linux
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 78.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 31
Description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: add the missing error handling inside get_canonical_dev_path
Inside function get_canonical_dev_path(), we call d_path() to get the
final device path.
But d_path() can return error, and in that case the next strscpy() call
will trigger an invalid memory access.
Add back the missing error handling for d_path().
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux5d261f60b5c82ba1e4b5555252e1c90c43d96015 — d0fb5741932b831eded49bfaaf33353e96200d6d+2
Patches
🔴Vulnerability Details
2GHSA▶
GHSA-vh4g-mh2m-pgg3: In the Linux kernel, the following vulnerability has been resolved:
btrfs: add the missing error handling inside get_canonical_dev_path
Inside funct↗2025-01-31
OSV▶
CVE-2025-21679: In the Linux kernel, the following vulnerability has been resolved: btrfs: add the missing error handling inside get_canonical_dev_path Inside functio↗2025-01-31