CVE-2025-21672

afs: Fix merge preference rule failure condition

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix merge preference rule failure condition

syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released.

Fix this by store the error in ret and jump to done to clean up instead of returning directly.

[dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()]

[1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted

syz-executor133/5823 is leaving the kernel with locks still held! 1 lock held by syz-executor133/5823: #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline] #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: afs_proc_addr_prefs_write+0x2bb/0x14e0 fs/afs/addr_prefs.c:388

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.14%Up 0.1 points since Feb 1, 2025

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix merge preference rule failure condition

syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released.

Fix this by store the error in ret and jump to done to clean up instead of returning directly.

[dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()]

[1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted

Record: CVE-2025-21672
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-667
Updated: 2026-11-02

CVE List 5.5

afs: Fix merge preference rule failure condition

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix merge preference rule failure condition

syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released.

Fix this by store the error in ret and jump to done to clean up instead of returning directly.

[dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()]

[1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted

Record: CVE-2025-21672
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-667
Updated: 2026-11-02

EUVDEUVD-2025-2621 5.5

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix merge preference rule failure condition

syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released.

Fix this by store the error in ret and jump to done to clean up instead of returning directly.

[dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()]

[1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted

Record: EUVD-2025-2621
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-94vp-7849-58r6 5.5

In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference...

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix merge preference rule failure condition

syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released.

Fix this by store the error in ret and jump to done to clean up instead of returning directly.

[dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()]

[1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted

Record: GHSA-94vp-7849-58r6
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-667
Updated: 2026-11-02

OSVAZL-56285 5.5

CVE-2025-21672 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix merge preference rule failure condition

syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released.

Fix this by store the error in ret and jump to done to clean up instead of returning directly.

[dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()]

[1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted

Record: AZL-56285
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-56327 5.5

CVE-2025-21672 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix merge preference rule failure condition

syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released.

Fix this by store the error in ret and jump to done to clean up instead of returning directly.

[dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()]

[1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted

Record: AZL-56327
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-05

Show 19 moreShow less

OSVBELL-CVE-2025-21672 5.5

Record: BELL-CVE-2025-21672
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 5.5

afs: Fix merge preference rule failure condition

In the Linux kernel, the following vulnerability has been resolved:

afs: Fix merge preference rule failure condition

syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released.

Fix this by store the error in ret and jump to done to clean up instead of returning directly.

[dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()]

[1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted

Record: CVE-2025-21672
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-21672 5.5

In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released. Fix this by store the error in ret and jump to done to clean up instead of returning directly. [dh: Modified Lizhi Xu's original patch to make it honour the error code from afs_split_string()] [1] WARNING: lock held when returning to user space! 6.13.0-rc3-syzkaller-00209-g499551201b5f #0 Not tainted ------------------------------------------------ syz-executor133/5823 is leaving the kernel with locks still held! 1 lock held by syz-executor133/5823: #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: inode_lock include/linux/fs.h:818 [inline] #0: ffff888071cffc00 (&sb->s_type->i_mutex_key#9){++++}-{4:4}, at: afs_proc_addr_prefs_write+0x2bb/0x14e0 fs/afs/addr_prefs.c:388

Record: DEBIAN-CVE-2025-21672
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:20518 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2025:20518
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2025:20518 7.8

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)
kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)
kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)
kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)
kernel: x86/tdx: Fix "in-kernel MMIO" check (CVE-2024-47727)
kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)
kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060)
kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024)
kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195)
kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294)
kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052)
kernel: afs: Fix lock recursion (CVE-2024-53090)
kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)
kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135)
kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241)
kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229)
kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170)
kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)
kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)
kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)
kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)
kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690)
kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709)
kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739)
kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786)
kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)
kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680)
kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)
kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)
kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631)
kernel: zram: fix potential UAF of zram table (CVE-2025-21671)
kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672)
kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)
kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)
kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)
kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
kernel: usbnet: fix memory leak in error case (CVE-2022-49657)
kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432)
kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672)
kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353)
kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437)
kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)
kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)
kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269)
kernel:…

Record: RLSA-2025:20518
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2025-21672 5.5

CVE-2025-21672 in linux - Patched by Root

Root has patched CVE-2025-21672 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2025-21672
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-21672 6.8

Record: UBUNTU-CVE-2025-21672
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2025:20518 No score

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830)
kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689)
kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744)
kernel: vfs: fix race between evice_inodes() and find_inode()&iput() (CVE-2024-47679)
kernel: x86/tdx: Fix "in-kernel MMIO" check (CVE-2024-47727)
kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864)
kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060)
kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024)
kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195)
kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294)
kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052)
kernel: afs: Fix lock recursion (CVE-2024-53090)
kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119)
kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135)
kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241)
kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229)
kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170)
kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216)
kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672)
kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662)
kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675)
kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690)
kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709)
kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739)
kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786)
kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332)
kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680)
kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648)
kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647)
kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631)
kernel: zram: fix potential UAF of zram table (CVE-2025-21671)
kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672)
kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693)
kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691)
kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696)
kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702)
kernel: usbnet: fix memory leak in error case (CVE-2022-49657)
kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432)
kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672)
kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353)
kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437)
kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627)
kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670)
kernel: can: isotp: sanitize CAN ID…

Record: ALSA-2025:20518
Updated: 2026-11-02

OSVCLSA-2026-1778787063 No score

kernel: Fix of 123 CVEs

net: skbuff: propagate shared-frag marker through pskb_copy()
mptcp: always handle address removal under msk socket lock {CVE-2025-21875}
uprobes: Reject the shared zeropage in uprobe_write_opcode() {CVE-2025-21881}
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error {CVE-2025-21924}
wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() {CVE-2025-21744}
mptcp: fix NULL pointer in can_accept_new_subflow {CVE-2025-23145}
bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock {CVE-2025-21951}
blk-cgroup: Fix class @block_class's subsystem refcount leakage {CVE-2025-21745}
net/mlx5: handle errors in mlx5_chains_create_table() {CVE-2025-21975}
USB: hub: Ignore non-compliant devices with too many configs or interfaces {CVE-2025-21776}
wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
ice: fix memory leak in aRFS after reset {CVE-2025-21981}
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel {CVE-2025-21779}
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken {CVE-2025-38099}
regulator: check that dummy regulator has been probed before using it {CVE-2025-22008}
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl {CVE-2025-22044}
drm/scheduler: signal scheduled fence when kill job {CVE-2025-38436}
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request {CVE-2025-38430}
net: decrease cached dst counters in dst_release {CVE-2025-22057}
bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT {CVE-2025-38439}
net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103}
dlm: prevent NPD when writing a positive value to event_done {CVE-2025-23131}
drm/amd/display: fix a Null pointer dereference vulnerability {CVE-2025-39705}
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree {CVE-2025-38468}
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params {CVE-2025-21941}
drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities {CVE-2025-39707}
HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
usb: net: sierra: check for no status endpoint {CVE-2025-38474}
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() {CVE-2025-38643}
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063}
vxlan: Fix NPD when refreshing an FDB entry with a nexthop object {CVE-2025-39851}
thermal: int340x: Add NULL check for adev {CVE-2025-23136}
Bluetooth: l2cap: Check encryption key size on incoming connection {CVE-2025-39889}
dm thin: make get_first_thin use rcu-safe list first function {CVE-2025-21664}
tracing: Add down_write(trace_event_sem) when adding trace event {CVE-2025-38539}
usbnet: Fix using smp_processor_id() in preemptible code warnings {CVE-2025-40164}
bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
ima: Fix a potential integer overflow in ima_appraise_measurement {CVE-2022-49643}
dm-stripe: fix a possible integer overflow {CVE-2025-39940}
usbnet: gl620a: fix endpoint checking in genelink_bind() {CVE-2025-21877}
fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
usbnet: fix memory leak in error case {CVE-2022-49657}
wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
can: j1939: j1939_send_one(): fix missing CAN header initialization {CVE-2022-49845}
ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
posix-clock: Fix missing timespec64 check in pc_clock_settime() {CVE-2024-50195}
net_sched: Prevent creation of classes with TC_H_ROOT {CVE-2025-21971}
mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow…

Record: CLSA-2026-1778787063
Updated: 2026-11-02

OSVUSN-7445-1 No score

linux, linux-aws, linux-gcp, linux-hwe-6.11, linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oem-6.11, linux-oracle, linux-raspi, linux-realtime vulnerabilities