CVE-2025-21667

iomap: avoid avoid truncating 64-bit offset to 32 bits

State: Published
Severity: 5.5 Medium
Published: Jan 31, 2025
Updated: May 23, 2026
Reserved: Dec 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

iomap: avoid avoid truncating 64-bit offset to 32 bits

on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Affected Products

Product	Versions
LinuxLinux	38be53c3fd7f4f4bd5de319a323d72f9f6beb16d to before 7ca4bd6b754913910151acce00be093f03642725Affected f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 to before 91371922704c8d82049ef7c2ad974d0a2cd1174dAffected f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 to before 402ce16421477e27f30b57d6d1a6dc248fa3a4e4Affected f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 to before c13094b894de289514d84b8db56d1f2931a0badeAffected 6.1.92 to before 6.1.127Affected
LinuxLinux	6.2Affected before 6.2Not affected 6.1.127 through 6.1.Not affected 6.6.74 through 6.6.Not affected 6.12.11 through 6.12.*Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

38be53c3fd7f4f4bd5de319a323d72f9f6beb16d to before 7ca4bd6b754913910151acce00be093f03642725Affected
f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 to before 91371922704c8d82049ef7c2ad974d0a2cd1174dAffected
f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 to before 402ce16421477e27f30b57d6d1a6dc248fa3a4e4Affected
f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 to before c13094b894de289514d84b8db56d1f2931a0badeAffected
6.1.92 to before 6.1.127Affected

LinuxLinux

6.2Affected
before 6.2Not affected
6.1.127 through 6.1.*Not affected
6.6.74 through 6.6.*Not affected
6.12.11 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.