Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-37863

ovl: don't allow datadir only

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ovl: don't allow datadir only In theory overlayfs could support upper layer directly referring to a data layer, but there's no current use case for this. Originally, when data-only layers were introduced, this wasn't allowed, only introduced by the "datadir+" feature, but without actually handling this case, resulting in an Oops. Fix by disallowing datadir without lowerdir.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • cc0918b3582c98f12cfb30bf7496496d14bff3e9 to < 0874b629f65320778e7e3e206177770666d9db18affected
  • 24e16e385f2272b1a9df51337a5c32d28a29c7ad to < b9e3579213ba648fa23f780e8d53e99011c62331affected
  • 24e16e385f2272b1a9df51337a5c32d28a29c7ad to < 21d2ffb0e9838a175064c22f3a9de97d1f56f27daffected
  • 24e16e385f2272b1a9df51337a5c32d28a29c7ad to < eb3a04a8516ee9b5174379306f94279fc90424c4affected
  • 6.6.23 to < 6.6.88affected

Linux Linux

Default version status: affected

  • 6.7affected
  • 0 to < 6.7unaffected
  • 6.6.88 to ≤ 6.6.*unaffected
  • 6.12.25 to ≤ 6.12.*unaffected
  • 6.14.4 to ≤ 6.14.*unaffected
  • 6.15 to ≤ *unaffected

References