Infinite Loop Vulnerability in Linux Kernel: iomap Truncation Issue
Summary
CVE-2025-21667: In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to f... Affects linux versions < 6.1.128-1. Fixed in 6.1.128-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system security. It is widely used in various distributions, including Debian. The kernel's iomap functionality is responsible for managing input/output operations, particularly for filesystems like XFS. This vulnerability arises from a flaw in the iomap_write_delalloc_scan function, which can lead to severe performance issues.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the iomap_write_delalloc_scan function inadvertently uses a 32-bit position due to the folio_next_index function returning an unsigned long. This truncation can lead to an infinite loop when writing to an XFS filesystem, potentially causing system hangs and data loss. The issue is particularly critical on 32-bit kernels, where the 64-bit offset is improperly handled.
How To Fix
Minimum fixed version
6.1.128-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid writing to XFS filesystems on 32-bit kernels until the patch is applied.
Conclusion
The CVE-2025-21667 vulnerability in the Linux kernel poses a significant risk for users operating on 32-bit systems with XFS filesystems. It is crucial to update the kernel to the latest patched version to mitigate this risk and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21667 is a vulnerability in the Linux kernel that can cause an infinite loop when writing to an XFS filesystem due to improper handling of 64-bit offsets.
The vulnerability affects the Linux kernel across various Debian versions, including Debian 11, 12, and 13.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If you cannot update your kernel, it is advisable to avoid writing to XFS filesystems on 32-bit kernels until a patch is applied.
Yes, due to the potential for an infinite loop, there is a risk of system hangs and possible data loss when writing to affected filesystems.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
