{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21830", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.776Z", "datePublished": "2025-03-06T16:08:09.894Z", "dateUpdated": "2026-08-05T11:54:47.539Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:47.539Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Handle weird files\n\nA corrupted filesystem (e.g. bcachefs) might return weird files.\nInstead of throwing a warning and allowing access to such file, treat\nthem as regular files." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only via local `renameat2(2)`/`linkat(2)` on an inode backed by a mounted crafted filesystem image, plus local Landlock syscalls to establish the domain. No network-facing consumer exists — NFS, SMB and FUSE clients all normalize or reject the invalid `S_IFMT` values before they reach an inode.\nAC:L - The attacker crafts the bcachefs/JFS/HFS+ image containing the weird-mode inode and drives the rename himself from a self-created Landlock domain, so the trigger is deterministic with no race, timing, or memory-layout dependency.\nPR:L - `landlock_create_ruleset()`/`landlock_restrict_self()` require no capability at all, and an ordinary desktop/kiosk console user can get an attacker-supplied image mounted through udisks2 removable-media automount without root; only a local unprivileged account is needed.\nUI:N - The attacker performs the entire sequence — supply the image, self-sandbox with Landlock, issue the rename or link — with no action required from another user.\nS:C - The fail-open `return 0` bypasses the Landlock sandbox boundary, letting a confined process act on filesystem resources that the sandbox policy placed under a separate security authority, consistent with the `S:C` treatment of the analogous Landlock refer-path bypass in CVE-2025-68736.\nC:N - No memory is read out of bounds and no kernel data is exposed; the anti-right-widening logic in `collect_domain_accesses()` uses the full `LANDLOCK_MASK_ACCESS_FS` and is unaffected, so no read rights are gained.\nI:L - Dropping the `LANDLOCK_ACCESS_FS_MAKE_*` requirement lets a sandboxed process create, link, or relocate weird-typed files into directories the policy protects, but the bypass is confined to same-mount operations on corrupt inodes and DAC still applies, so the unauthorized modification is limited.\nA:H - The path hits `WARN_ON_ONCE(1)`, which panics the kernel outright when `panic_on_warn` is set — the configuration under which syzbot reported this — giving a full denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/landlock/fs.c" ], "versions": [ { "version": "cb2c7d1a1776057c9a1f48ed1250d85e94d4850d", "lessThan": "a1fccf6b72b56343dd4f2d96b008147f9951eebd", "status": "affected", "versionType": "git" }, { "version": "cb2c7d1a1776057c9a1f48ed1250d85e94d4850d", "lessThan": "7d6121228959ddf44a4b9b6a177384ac7854e2f9", "status": "affected", "versionType": "git" }, { "version": "cb2c7d1a1776057c9a1f48ed1250d85e94d4850d", "lessThan": "39bb3d56f1c351e76bb18895d0e73796e653d5c1", "status": "affected", "versionType": "git" }, { "version": "cb2c7d1a1776057c9a1f48ed1250d85e94d4850d", "lessThan": "2569e65d2eb6ac1afe6cb6dfae476afee8b6771a", "status": "affected", "versionType": "git" }, { "version": "cb2c7d1a1776057c9a1f48ed1250d85e94d4850d", "lessThan": "0fde195a373ab1267e60baa9e1a703a97e7464cd", "status": "affected", "versionType": "git" }, { "version": "cb2c7d1a1776057c9a1f48ed1250d85e94d4850d", "lessThan": "49440290a0935f428a1e43a5ac8dc275a647ff80", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/landlock/fs.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.129" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/a1fccf6b72b56343dd4f2d96b008147f9951eebd" }, { "url": "https://git.kernel.org/stable/c/7d6121228959ddf44a4b9b6a177384ac7854e2f9" }, { "url": "https://git.kernel.org/stable/c/39bb3d56f1c351e76bb18895d0e73796e653d5c1" }, { "url": "https://git.kernel.org/stable/c/2569e65d2eb6ac1afe6cb6dfae476afee8b6771a" }, { "url": "https://git.kernel.org/stable/c/0fde195a373ab1267e60baa9e1a703a97e7464cd" }, { "url": "https://git.kernel.org/stable/c/49440290a0935f428a1e43a5ac8dc275a647ff80" } ], "title": "landlock: Handle weird files", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:00:01.286Z" } } ] } }