LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21896: fuse: revert back to __readahead_folio() for readahead

In the Linux kernel, the following vulnerability has been resolved: fuse: revert back to __readahead_folio() for readahead In commit 3eab9d7bc2f4 ("fuse: convert readahead to use folios"), the logic was converted to using the new folio readahead code, which drops the reference on the folio once it is locked, using an inferred reference on the folio. Previously we held a reference on the folio for the entire duration of the readpages call. This is fine, however for the case for splice pipe responses where we will remove the old folio and splice in the new folio (see fuse_try_move_page()), we assume that there is a reference held on the folio for ap->folios, which is no longer the case. To fix this, revert back to __readahead_folio() which allows us to hold the reference on the folio for the duration of readpages until either we drop the reference ourselves in fuse_readpages_end() or the reference is dropped after it's replaced in the page cache in the splice case. This will fix the UAF bug that was reported.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel FUSE flaw can cause use-after-free memory access during a specific file-read response path. A local, low-privileged attacker may be able to compromise confidentiality, integrity, or availability. The supplied record rates it 7.8 High, but provides no evidence of active exploitation.

Executive priority

Treat this as a high-priority kernel update for multi-user systems, shared compute, and hosts exposing FUSE to untrusted users. Schedule remediation promptly through normal kernel patching and reboot processes. Emergency response is not supported by the supplied evidence because active exploitation is not reported.

Technical view

A folio readahead conversion stopped retaining a reference throughout readpages. The FUSE splice-response path, particularly fuse_try_move_page(), still assumed that reference existed when replacing a folio, creating a use-after-free condition. The cited kernel changes restore __readahead_folio() so the reference remains valid until explicitly released or replaced.

Likely exposure

Exposure requires an affected Linux kernel and local low-privileged access; no user interaction is required. The vulnerable behavior involves FUSE readahead with splice pipe responses. The supplied affected-version metadata identifies Linux 6.13, through 6.13.6, and 6.14, but its formatting is ambiguous; confirm distribution backports directly.

Exploitation context

The CVSS vector indicates local, low-complexity exploitation requiring low privileges, with potentially high confidentiality, integrity, and availability impact. The source bundle marks the CVE as absent from KEV and cites no observed exploitation, public exploit, or attack campaign. This does not establish that exploitation is impossible.

Researcher notes

This is a reference-lifetime regression introduced by the folio readahead conversion. Risk centers on the mismatch between inferred folio ownership and fuse_try_move_page() assumptions during splice replacement. The record describes the root cause and correction, but provides no CWE, exploitability demonstration, affected-distribution mapping, or evidence of exploitation.

Mitigation direction

  • Apply a vendor-supported kernel update containing the cited FUSE correction or an equivalent backport.
  • Check distribution security guidance because package versions may differ from upstream kernel numbering.
  • Prioritize systems where untrusted local users can interact with FUSE-backed filesystems.
  • Where immediate patching is impossible, restrict untrusted local access and unnecessary FUSE use after operational review.

Validation and detection

  • Record each system's running kernel version and distribution package release.
  • Confirm whether the distribution kernel contains either cited corrective commit or an equivalent backport.
  • Identify hosts using FUSE and allowing untrusted local users.
  • Reboot after kernel replacement, then verify the running kernel matches the remediated package.
  • Review vendor advisories for corrected version ranges because the supplied affected metadata is ambiguous.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21896 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-21896Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3eab9d7bc2f4ae7f3f9c9c7852ff61600df79856, 3eab9d7bc2f4ae7f3f9c9c7852ff61600df79856unaffected
LinuxLinux6.13, 0, 6.13.6, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.