OverlayFS Vulnerability in Linux Kernel: Inotify Handling Issue
Summary
DEBIAN-CVE-2025-21654: In the Linux kernel, the following vulnerability has been resolved: ovl: support encoding fid from inode with no alias Dmitry Safonov reported that a WARN_ON() assertion can be trigered by userspace when calling inotify_... Affects linux versions < 6.12.10-1. Fixed in 6.12.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports various file systems, including OverlayFS, which allows users to create a layered file system. This functionality is crucial for containerization and virtualization. However, a recent vulnerability has been identified in the OverlayFS implementation, affecting Debian versions 13 and 14.
Vulnerability Detail
In the Linux kernel, a vulnerability has been reported related to OverlayFS, specifically in the handling of inotify events for inodes whose dentry aliases were discarded. This issue can trigger a WARN_ON() assertion when userspace calls inotify_show_fdinfo() on an affected inode. The failure to encode an OverlayFS file handle from a non-aliased inode can lead to incomplete reporting of FAN_DELETE_SELF fanotify events, which may impact applications relying on accurate file event notifications.
How To Fix
Minimum fixed version
6.12.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
The vulnerability in the Linux kernel's OverlayFS implementation poses a risk to applications relying on file event notifications. Users are encouraged to update their systems to the patched version to mitigate potential impacts. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to failures in reporting file events, particularly FAN_DELETE_SELF events, which may affect applications that depend on accurate file monitoring.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Yes, a patch has been released in version 6.12.10-1 for the Linux kernel on Debian systems.
While there are no specific workarounds, it is advisable to monitor your system closely for any unusual behavior until you can apply the patch.
Detailed information can be found in the Debian CVE database and through security advisories related to the Linux kernel.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
