CVE-2025-21721: nilfs2: handle errors that nilfs_prepare_chunk() may return
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: handle errors that nilfs_prepare_chunk() may return
Patch series "nilfs2: fix issues with rename operations".
This series fixes BUG_ON check failures reported by syzbot around rename
operations, and a minor behavioral issue where the mtime of a child
directory changes when it is renamed instead of moved.
This patch (of 2):
The directory manipulation routines nilfs_set_link() and
nilfs_delete_entry() rewrite the directory entry in the folio/page
previously read by nilfs_find_entry(), so error handling is omitted on the
assumption that nilfs_prepare_chunk(), which prepares the buffer for
rewriting, will always succeed for these. And if an error is returned, it
triggers the legacy BUG_ON() checks in each routine.
This assumption is wrong, as proven by syzbot: the buffer layer called by
nilfs_prepare_chunk() may call nilfs_get_block() if necessary, which may
fail due to metadata corruption or other reasons. This has been there all
along, but improved sanity checks and error handling may have made it more
reproducible in fuzzing tests.
Fix this issue by adding missing error paths in nilfs_set_link(),
nilfs_delete_entry(), and their caller nilfs_rename().
Security readout for executives and security teams
Plain-English summary
CVE-2025-21721 is a Linux kernel NILFS2 filesystem bug where rename-related directory updates can hit a kernel BUG check if lower-level preparation fails. The public record does not provide CVSS, CWE, or confirmed exploitation. Business impact is mainly availability risk on systems that use affected Linux kernels with NILFS2.
Executive priority
Prioritize routine kernel patching, elevated for servers that use NILFS2 or process removable or less-trusted filesystem media. No source indicates emergency exploitation, but kernel BUG conditions can affect availability.
Technical view
The flaw is missing error handling in nilfs_set_link(), nilfs_delete_entry(), and nilfs_rename(). nilfs_prepare_chunk() was assumed to succeed after nilfs_find_entry(), but it can fail through buffer-layer paths such as nilfs_get_block(), including from metadata corruption, triggering legacy BUG_ON checks.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with NILFS2 enabled or mounted. Systems not using NILFS2 have lower practical exposure, though kernel package status should still be verified.
Exploitation context
The sources describe syzbot-triggered BUG_ON failures during rename operations. There is no KEV listing and no cited evidence of active exploitation or public weaponization in the provided bundle.
Researcher notes
The record links multiple stable commits and Debian LTS advisories. The affected-version data is broad and includes commit identifiers plus kernel release ranges, so validate against vendor backports rather than upstream version numbers alone.
Mitigation direction
Update to a vendor kernel containing the referenced stable NILFS2 fixes.
Apply relevant Debian LTS kernel updates where Debian LTS is in scope.
Check distribution advisories for the exact fixed package version.
Avoid introducing NILFS2 use on unpatched systems.
Treat corrupted NILFS2 metadata reports as a patching priority.
Validation and detection
Inventory systems running Linux kernels in the affected version ranges.
Identify hosts with NILFS2 support enabled or NILFS2 filesystems mounted.
Confirm installed kernels include the referenced stable commits or distro backports.
Review kernel logs for NILFS2 BUG, oops, or rename-related failures.
Track vendor advisories until affected assets show fixed kernel packages.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-21721 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
1ADP providers
11Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Feb 27, 2025, 02:07 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.