{"id":"CVE-2025-21643","summary":"netfs: Fix kernel async DIO","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix kernel async DIO\n\nNetfslib needs to be able to handle kernel-initiated asynchronous DIO that\nis supplied with a bio_vec[] array.  Currently, because of the async flag,\nthis gets passed to netfs_extract_user_iter() which throws a warning and\nfails because it only handles IOVEC and UBUF iterators.  This can be\ntriggered through a combination of cifs and a loopback blockdev with\nsomething like:\n\n        mount //my/cifs/share /foo\n        dd if=/dev/zero of=/foo/m0 bs=4K count=1K\n        losetup --sector-size 4096 --direct-io=on /dev/loop2046 /foo/m0\n        echo hello \u003e/dev/loop2046\n\nThis causes the following to appear in syslog:\n\n        WARNING: CPU: 2 PID: 109 at fs/netfs/iterator.c:50 netfs_extract_user_iter+0x170/0x250 [netfs]\n\nand the write to fail.\n\nFix this by removing the check in netfs_unbuffered_write_iter_locked() that\ncauses async kernel DIO writes to be handled as userspace writes.  Note\nthat this change relies on the kernel caller maintaining the existence of\nthe bio_vec array (or kvec[] or folio_queue) until the op is complete.","modified":"2026-03-20T12:40:37.873601Z","published":"2025-01-19T10:17:59.820Z","related":["USN-7379-2","USN-7380-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21643.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3f6bc9e3ab9b127171d39f9ac6eca1abb693b731"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9f3a265836844eda30bf34c2584b8011fd4f0f49"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21643.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21643"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"153a9961b551101cd38e94e26cd92fbfd198b19b"},{"fixed":"9f3a265836844eda30bf34c2584b8011fd4f0f49"},{"fixed":"3f6bc9e3ab9b127171d39f9ac6eca1abb693b731"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21643.json"}}],"schema_version":"1.7.5"}