What’s Vulnerable › Vulnerabilities

CVE-2025-21667: iomap: avoid avoid truncating 64-bit offset to 32 bits

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-31 · updated 2026-06-17
• Weakness: CWE-835

Description

In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem.

Affected products

• Linux kernel: before 6.1.127; from 6.2 before 6.6.74; from 6.7 before 6.12.11; 6.13-rc1, 6.13-rc2, 6.13-rc3, 6.13-rc4, 6.13-rc5, 6.13-rc6 — fixed in 6.1.127, 6.12.11, 6.6.74

How to fix

Upgrade to a fixed version: Linux kernel 6.1.127, 6.12.11, 6.6.74. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/402ce16421477e27f30b57d6d1a6dc248fa3a4e4
• https://git.kernel.org/stable/c/7ca4bd6b754913910151acce00be093f03642725
• https://git.kernel.org/stable/c/91371922704c8d82049ef7c2ad974d0a2cd1174d
• https://git.kernel.org/stable/c/c13094b894de289514d84b8db56d1f2931a0bade
• https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

Get alerted when CVE-2025-21667 or the next vulnerability affects your stack