{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21830","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.776Z","datePublished":"2025-03-06T16:08:09.894Z","dateUpdated":"2026-08-05T11:54:47.539Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:54:47.539Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Handle weird files\n\nA corrupted filesystem (e.g. bcachefs) might return weird files.\nInstead of throwing a warning and allowing access to such file, treat\nthem as regular files."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only via local `renameat2(2)`/`linkat(2)` on an inode backed by a mounted crafted filesystem image, plus local Landlock syscalls to establish the domain. No network-facing consumer exists — NFS, SMB and FUSE clients all normalize or reject the invalid `S_IFMT` values before they reach an inode.\nAC:L - The attacker crafts the bcachefs/JFS/HFS+ image containing the weird-mode inode and drives the rename himself from a self-created Landlock domain, so the trigger is deterministic with no race, timing, or memory-layout dependency.\nPR:L - `landlock_create_ruleset()`/`landlock_restrict_self()` require no capability at all, and an ordinary desktop/kiosk console user can get an attacker-supplied image mounted through udisks2 removable-media automount without root; only a local unprivileged account is needed.\nUI:N - The attacker performs the entire sequence — supply the image, self-sandbox with Landlock, issue the rename or link — with no action required from another user.\nS:C - The fail-open `return 0` bypasses the Landlock sandbox boundary, letting a confined process act on filesystem resources that the sandbox policy placed under a separate security authority, consistent with the `S:C` treatment of the analogous Landlock refer-path bypass in CVE-2025-68736.\nC:N - No memory is read out of bounds and no kernel data is exposed; the anti-right-widening logic in `collect_domain_accesses()` uses the full `LANDLOCK_MASK_ACCESS_FS` and is unaffected, so no read rights are gained.\nI:L - Dropping the `LANDLOCK_ACCESS_FS_MAKE_*` requirement lets a sandboxed process create, link, or relocate weird-typed files into directories the policy protects, but the bypass is confined to same-mount operations on corrupt inodes and DAC still applies, so the unauthorized modification is limited.\nA:H - The path hits `WARN_ON_ONCE(1)`, which panics the kernel outright when `panic_on_warn` is set — the configuration under which syzbot reported this — giving a full denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/landlock/fs.c"],"versions":[{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","lessThan":"a1fccf6b72b56343dd4f2d96b008147f9951eebd","status":"affected","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","lessThan":"7d6121228959ddf44a4b9b6a177384ac7854e2f9","status":"affected","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","lessThan":"39bb3d56f1c351e76bb18895d0e73796e653d5c1","status":"affected","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","lessThan":"2569e65d2eb6ac1afe6cb6dfae476afee8b6771a","status":"affected","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","lessThan":"0fde195a373ab1267e60baa9e1a703a97e7464cd","status":"affected","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","lessThan":"49440290a0935f428a1e43a5ac8dc275a647ff80","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/landlock/fs.c"],"versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","status":"unaffected","versionType":"semver"},{"version":"5.15.179","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.129","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.76","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.13","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.2","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.1.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.6.76"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.12.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.13.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a1fccf6b72b56343dd4f2d96b008147f9951eebd"},{"url":"https://git.kernel.org/stable/c/7d6121228959ddf44a4b9b6a177384ac7854e2f9"},{"url":"https://git.kernel.org/stable/c/39bb3d56f1c351e76bb18895d0e73796e653d5c1"},{"url":"https://git.kernel.org/stable/c/2569e65d2eb6ac1afe6cb6dfae476afee8b6771a"},{"url":"https://git.kernel.org/stable/c/0fde195a373ab1267e60baa9e1a703a97e7464cd"},{"url":"https://git.kernel.org/stable/c/49440290a0935f428a1e43a5ac8dc275a647ff80"}],"title":"landlock: Handle weird files","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:00:01.286Z"}}]}}