{"id":"CVE-2025-21830","state":"PUBLISHED","title":"landlock: Handle weird files","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Handle weird files\n\nA corrupted filesystem (e.g. bcachefs) might return weird files.\nInstead of throwing a warning and allowing access to such file, treat\nthem as regular files.","publishedAt":"2025-03-06T16:08:09.894Z","updatedAt":"2026-10-15T21:51:53.705Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"a1fccf6b72b56343dd4f2d96b008147f9951eebd","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"7d6121228959ddf44a4b9b6a177384ac7854e2f9","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"39bb3d56f1c351e76bb18895d0e73796e653d5c1","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"2569e65d2eb6ac1afe6cb6dfae476afee8b6771a","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"0fde195a373ab1267e60baa9e1a703a97e7464cd","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"49440290a0935f428a1e43a5ac8dc275a647ff80","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/landlock/fs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.13","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.76","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.13","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.2","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/landlock/fs.c"]}],"references":["https://git.kernel.org/stable/c/a1fccf6b72b56343dd4f2d96b008147f9951eebd","https://git.kernel.org/stable/c/7d6121228959ddf44a4b9b6a177384ac7854e2f9","https://git.kernel.org/stable/c/39bb3d56f1c351e76bb18895d0e73796e653d5c1","https://git.kernel.org/stable/c/2569e65d2eb6ac1afe6cb6dfae476afee8b6771a","https://git.kernel.org/stable/c/0fde195a373ab1267e60baa9e1a703a97e7464cd","https://git.kernel.org/stable/c/49440290a0935f428a1e43a5ac8dc275a647ff80","https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/21xxx/CVE-2025-21830.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21830","state":"PUBLISHED","datePublished":"2025-03-06T16:08:09.894Z","dateUpdated":"2026-10-15T21:51:53.705Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-29T08:45:45.776Z"},"containers":{"cna":{"title":"landlock: Handle weird files","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Handle weird files\n\nA corrupted filesystem (e.g. bcachefs) might return weird files.\nInstead of throwing a warning and allowing access to such file, treat\nthem as regular files."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"a1fccf6b72b56343dd4f2d96b008147f9951eebd","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"7d6121228959ddf44a4b9b6a177384ac7854e2f9","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"39bb3d56f1c351e76bb18895d0e73796e653d5c1","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"2569e65d2eb6ac1afe6cb6dfae476afee8b6771a","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"0fde195a373ab1267e60baa9e1a703a97e7464cd","versionType":"git"},{"version":"cb2c7d1a1776057c9a1f48ed1250d85e94d4850d","status":"affected","lessThan":"49440290a0935f428a1e43a5ac8dc275a647ff80","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/landlock/fs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.13","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.76","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.13","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.2","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/landlock/fs.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/a1fccf6b72b56343dd4f2d96b008147f9951eebd"},{"url":"https://git.kernel.org/stable/c/7d6121228959ddf44a4b9b6a177384ac7854e2f9"},{"url":"https://git.kernel.org/stable/c/39bb3d56f1c351e76bb18895d0e73796e653d5c1"},{"url":"https://git.kernel.org/stable/c/2569e65d2eb6ac1afe6cb6dfae476afee8b6771a"},{"url":"https://git.kernel.org/stable/c/0fde195a373ab1267e60baa9e1a703a97e7464cd"},{"url":"https://git.kernel.org/stable/c/49440290a0935f428a1e43a5ac8dc275a647ff80"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only via local `renameat2(2)`/`linkat(2)` on an inode backed by a mounted crafted filesystem image, plus local Landlock syscalls to establish the domain. No network-facing consumer exists — NFS, SMB and FUSE clients all normalize or reject the invalid `S_IFMT` values before they reach an inode.\nAC:L - The attacker crafts the bcachefs/JFS/HFS+ image containing the weird-mode inode and drives the rename himself from a self-created Landlock domain, so the trigger is deterministic with no race, timing, or memory-layout dependency.\nPR:L - `landlock_create_ruleset()`/`landlock_restrict_self()` require no capability at all, and an ordinary desktop/kiosk console user can get an attacker-supplied image mounted through udisks2 removable-media automount without root; only a local unprivileged account is needed.\nUI:N - The attacker performs the entire sequence — supply the image, self-sandbox with Landlock, issue the rename or link — with no action required from another user.\nS:C - The fail-open `return 0` bypasses the Landlock sandbox boundary, letting a confined process act on filesystem resources that the sandbox policy placed under a separate security authority, consistent with the `S:C` treatment of the analogous Landlock refer-path bypass in CVE-2025-68736.\nC:N - No memory is read out of bounds and no kernel data is exposed; the anti-right-widening logic in `collect_domain_accesses()` uses the full `LANDLOCK_MASK_ACCESS_FS` and is unaffected, so no read rights are gained.\nI:L - Dropping the `LANDLOCK_ACCESS_FS_MAKE_*` requirement lets a sandboxed process create, link, or relocate weird-typed files into directories the policy protects, but the bypass is confined to same-mount operations on corrupt inodes and DAC still applies, so the unauthorized modification is limited.\nA:H - The path hits `WARN_ON_ONCE(1)`, which panics the kernel outright when `panic_on_warn` is set — the configuration under which syzbot reported this — giving a full denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:54:47.539Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.1.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.6.76"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.12.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.13.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13","versionEndExcluding":"6.14"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T21:00:01.286Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:04:37.308Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-21830","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T21:43:09.623797Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:51:53.705Z"}}]}}}