Junglewise Threat Intelligence

CVE-2025-21664: Linux Kernel race condition in dm-thin provisioner

CVE-2025-21664 · Severity: medium · CVSS 5.5 · Published 2025-01-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's device mapper component could allow a local user to cause a system crash. The issue occurs during specific storage management operations, such as deleting or suspending thin-provisioned volumes. This results in a complete denial of service for the affected system, potentially impacting business operations and data availability.

Technical details

A race condition exists in the dm-thin module of the Linux kernel due to the non-atomic use of RCU list functions. Specifically, the get_first_thin() function relied on a list_empty() check followed by a list_first() dereference. Because each function performs its own READ_ONCE() of the list head, a concurrent modification (such as a thin_dtr call) could empty the list between the two operations. This causes the kernel to dereference an invalid pointer, leading to a General Protection (GP) fault and system crash. The fix replaces the unsafe sequence with list_first_or_null_rcu(), which ensures a single atomic read of the list head.

Affected products

  • Linux Linux Kernel 3.15.1 to 5.4.289, 5.5 to 5.10.233, 5.11 to 5.15.176, 5.16 to 6.1.124, 6.2 to 6.6.71, 6.7 to 6.12.9

Timeline

  • 2025-01-07: patched: Initial patch authored
  • 2025-01-21: disclosed: CVE published

References

Related threats