← All advisories

Medium severity5.5NVD Advisory· Published Jan 31, 2025· Updated Jun 17, 2026

CVE-2025-21679

CVE-2025-21679

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: add the missing error handling inside get_canonical_dev_path

Inside function get_canonical_dev_path(), we call d_path() to get the final device path.

But d_path() can return error, and in that case the next strscpy() call will trigger an invalid memory access.

Add back the missing error handling for d_path().

Affected products

11

Linux/Kernelcpe-rescue10 versions
6.12.5+ 9 more
- (no CPE)range: 6.12.5
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.12.5,<6.12.11
- cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:*
- (no CPE)
osv-coords
pkg:linux/kernel
Range: >= 6.12.5, < 6.12.11

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.