Riskcovery

CVE-2025-37863

ovl: don't allow datadir only

State
Published
Severity
Not scored
Published
May 9, 2025
Updated
May 23, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ovl: don't allow datadir only

In theory overlayfs could support upper layer directly referring to a data layer, but there's no current use case for this.

Originally, when data-only layers were introduced, this wasn't allowed, only introduced by the "datadir+" feature, but without actually handling this case, resulting in an Oops.

Fix by disallowing datadir without lowerdir.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • cc0918b3582c98f12cfb30bf7496496d14bff3e9 to before 0874b629f65320778e7e3e206177770666d9db18Affected
  • 24e16e385f2272b1a9df51337a5c32d28a29c7ad to before b9e3579213ba648fa23f780e8d53e99011c62331Affected
  • 24e16e385f2272b1a9df51337a5c32d28a29c7ad to before 21d2ffb0e9838a175064c22f3a9de97d1f56f27dAffected
  • 24e16e385f2272b1a9df51337a5c32d28a29c7ad to before eb3a04a8516ee9b5174379306f94279fc90424c4Affected
  • 6.6.23 to before 6.6.88Affected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.6.88 through 6.6.*Not affected
  • 6.12.25 through 6.12.*Not affected
  • 6.14.4 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.