In the Linux kernel, the following vulnerability has been resolved:
proc: fix UAF in procgetinode()
Fix race between rmmod and /proc/XXX's inode instantiation.
The bug is that pde->procops don't belong to /proc, it belongs to a module, therefore dereferencing it after /proc entry has been registered is a bug unless usepde/unuse_pde() pair has been used.
usepde/unusepde can be avoided (2 atomic ops!) because pde->procops never changes so information necessary for inode instantiation can be saved before procregister() in PDE itself and used later, avoiding pde->proc_ops->... dereference.
rmmod lookup
sysdeletemodule proclookupde pdeget(de); procgetinode(dir->isb, de); mod->exit() procremove removeprocsubtree procentryrundown(de); freemodule(mod);
if (S_ISREG(inode->i_mode))
if (de->proc_ops->proc_read_iter)
--> As module is already freed, will trigger UAF
BUG: unable to handle page fault for address: fffffbfff80a702b PGD 817fc4067 P4D 817fc4067 PUD 817fc0067 PMD 102ef4067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 26 UID: 0 PID: 2667 Comm: ls Tainted: G Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:procgetinode+0x302/0x6e0 RSP: 0018:ffff88811c837998 EFLAGS: 00010a06 RAX: dffffc0000000000 RBX: ffffffffc0538140 RCX: 0000000000000007 RDX: 1ffffffff80a702b RSI: 0000000000000001 RDI: ffffffffc0538158 RBP: ffff8881299a6000 R08: 0000000067bbe1e5 R09: 1ffff11023906f20 R10: ffffffffb560ca07 R11: ffffffffb2b43a58 R12: ffff888105bb78f0 R13: ffff888100518048 R14: ffff8881299a6004 R15: 0000000000000001 FS: 00007f95b9686840(0000) GS:ffff8883af100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff80a702b CR3: 0000000117dd2000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> proclookupde+0x11f/0x2e0 __lookupslow+0x188/0x350 walkcomponent+0x2ab/0x4f0 path_lookupat+0x120/0x660 filenamelookup+0x1ce/0x560 vfsstatx+0xac/0x150 __dosysnewstat+0x96/0x110 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
[adobriyan@gmail.com: don't do 2 atomic ops on the common path]
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21999.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21999.json"
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"129319277118584708173044919302728567900",
"99164371574146757590112957556995626644",
"197760155185445403788960435012684170328",
"102381854999064998513139985839326969126",
"74005714608340685149006999605526663406",
"220624168292698008253120521922001444466",
"334875861226759192432489281863509967411",
"106815009337169640012023391656350135609",
"307970179490396376204123109624769757916",
"2862829344777370843203703659042490369"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64dc7c68e040251d9ec6e989acb69f8f6ae4a10b",
"signature_type": "Line",
"id": "CVE-2025-21999-34d5fb1e",
"target": {
"file": "fs/proc/inode.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "326381156262009128904029131822691683267",
"length": 1220.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64dc7c68e040251d9ec6e989acb69f8f6ae4a10b",
"signature_type": "Function",
"id": "CVE-2025-21999-3966e450",
"target": {
"file": "fs/proc/inode.c",
"function": "proc_get_inode"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "219236884500170221950024773240604806560",
"length": 153.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64dc7c68e040251d9ec6e989acb69f8f6ae4a10b",
"signature_type": "Function",
"id": "CVE-2025-21999-55f9373e",
"target": {
"file": "fs/proc/generic.c",
"function": "pde_set_flags"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "211990139586045436768935239434850287166",
"length": 346.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64dc7c68e040251d9ec6e989acb69f8f6ae4a10b",
"signature_type": "Function",
"id": "CVE-2025-21999-77fffc46",
"target": {
"file": "fs/proc/generic.c",
"function": "proc_create_seq_private"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"15915360698994555557350479859820668402",
"136301086087185102836430966317385577909",
"332519558662535750398481613450292274967",
"21107098822882447691879501717958972822",
"183064258112621179782837099442112937714",
"224106809820726749898283997940965393558",
"218770204651238818128833466811785456712",
"237986673503904357970811481913580422168",
"269923414813005767026971708855613588414",
"221155433839341317885637884608328411620",
"229451278346080238858884572501663032420",
"216615692894234180840799065481123473124",
"339544017651890811929388781563644981792",
"327404518043356724806412232683040216216",
"100211632730131772743906218650409302194"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64dc7c68e040251d9ec6e989acb69f8f6ae4a10b",
"signature_type": "Line",
"id": "CVE-2025-21999-a3d93f75",
"target": {
"file": "fs/proc/generic.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"59556433945133131786533142344831366262",
"263818656347473476922906614334421997595",
"135176107210378526285122159478916259767",
"216995278284794524665661864717623629966",
"281772149909794819038400606969032742997",
"86311953293753063323513398077434073337",
"41095079114792016093951558031063817407"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64dc7c68e040251d9ec6e989acb69f8f6ae4a10b",
"signature_type": "Line",
"id": "CVE-2025-21999-afa2ecef",
"target": {
"file": "include/linux/proc_fs.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"215335649401842720412013554153796697688",
"72950120601614660277845327494193908717",
"161365076739873967782475897519687013045"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64dc7c68e040251d9ec6e989acb69f8f6ae4a10b",
"signature_type": "Line",
"id": "CVE-2025-21999-b6ff62f5",
"target": {
"file": "fs/proc/internal.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "159712500879515778495797039136931417762",
"length": 327.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64dc7c68e040251d9ec6e989acb69f8f6ae4a10b",
"signature_type": "Function",
"id": "CVE-2025-21999-f25780e9",
"target": {
"file": "fs/proc/generic.c",
"function": "proc_create_single_data"
}
}
]