In the Linux kernel, the following vulnerability has been resolved:

iomap: avoid avoid truncating 64-bit offset to 32 bits

on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a
32-bit position due to folio_next_index() returning an unsigned long.
This could lead to an infinite loop when writing to an xfs filesystem.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00031.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
38be53c3fd7f4f4bd5de319a323d72f9f6beb16d affected < 7ca4bd6b754913910151acce00be093f03642725
f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 affected < 91371922704c8d82049ef7c2ad974d0a2cd1174d
f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 affected < 402ce16421477e27f30b57d6d1a6dc248fa3a4e4
f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 affected < c13094b894de289514d84b8db56d1f2931a0bade
Linux Linux affected
Version Status Constraints
6.2 affected —
0 unaffected < 6.2
6.1.127 unaffected ≤ 6.1.*
6.6.74 unaffected ≤ 6.6.*
6.12.11 unaffected ≤ 6.12.*
6.13 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4076-1 linux-6.1 security update
EUVD EUVD EUVD-2025-2616 In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem.
Ubuntu USN Ubuntu USN USN-7445-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7448-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7595-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7595-2 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7595-3 Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7595-4 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7595-5 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7596-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7596-2 Linux kernel (Azure, N-Series) vulnerabilities
Ubuntu USN Ubuntu USN USN-7653-1 Linux kernel (HWE) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/402ce16421477e27f30b57d6d1a6dc248fa3a4e4 cve-icon cve-icon
https://git.kernel.org/stable/c/7ca4bd6b754913910151acce00be093f03642725 cve-icon cve-icon
https://git.kernel.org/stable/c/91371922704c8d82049ef7c2ad974d0a2cd1174d cve-icon cve-icon
https://git.kernel.org/stable/c/c13094b894de289514d84b8db56d1f2931a0bade cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html cve-icon
https://lore.kernel.org/linux-cve-announce/2025013158-CVE-2025-21667-a644@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-21667 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-21667 cve-icon
History

Mon, 03 Nov 2025 21:30:00 +0000

Type Values Removed Values Added
References

Wed, 01 Oct 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00027}

 epss

{'score': 0.00028}

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00018}

 epss

{'score': 0.00027}

Mon, 03 Feb 2025 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-835
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Sat, 01 Feb 2025 02:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 31 Jan 2025 11:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem.
Title iomap: avoid avoid truncating 64-bit offset to 32 bits
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-11-03T20:58:46.039Z

Reserved: 2024-12-29T08:45:45.733Z

Link: CVE-2025-21667

cve-icon Vulnrichment

Updated: 2025-11-03T20:58:46.039Z

cve-icon NVD

Status : Modified

Published: 2025-01-31T12:15:27.863

Modified: 2025-11-03T21:19:04.133

Link: CVE-2025-21667

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-01-31T00:00:00Z

Links: CVE-2025-21667 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses