CVE-2025-21679Incorrect Check of Function Return Value in Linux

Severity
5.5MEDIUMNVD
EPSS
0.1%
top 78.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJan 31

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: add the missing error handling inside get_canonical_dev_path Inside function get_canonical_dev_path(), we call d_path() to get the final device path. But d_path() can return error, and in that case the next strscpy() call will trigger an invalid memory access. Add back the missing error handling for d_path().

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

NVDlinux/linux_kernel6.12.56.12.11+1
Debianlinux/linux_kernel< 6.12.11-1+1
CVEListV5linux/linux5d261f60b5c82ba1e4b5555252e1c90c43d96015d0fb5741932b831eded49bfaaf33353e96200d6d+2
debiandebian/linux< linux 6.12.11-1 (forky)

Patches

🔴Vulnerability Details

2
GHSA
GHSA-vh4g-mh2m-pgg3: In the Linux kernel, the following vulnerability has been resolved: btrfs: add the missing error handling inside get_canonical_dev_path Inside funct2025-01-31
OSV
CVE-2025-21679: In the Linux kernel, the following vulnerability has been resolved: btrfs: add the missing error handling inside get_canonical_dev_path Inside functio2025-01-31

📋Vendor Advisories

2
Red Hat
kernel: btrfs: add the missing error handling inside get_canonical_dev_path2025-01-31
Debian
CVE-2025-21679: linux - In the Linux kernel, the following vulnerability has been resolved: btrfs: add ...2025
CVE-2025-21679 — Linux vulnerability | cvebase