CVE-2025-37863

ovl: don't allow datadir only

MEDIUM

5.5

CVSS Score

Published: May 9, 2025 at 06:43 AM UTC

Updated: June 17, 2026 at 09:15 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: ovl: don't allow datadir only In theory overlayfs could support upper layer directly referring to a data layer, but there's no current use case for this. Originally, when data-only layers were introduced, this wasn't allowed, only introduced by the "datadir+" feature, but without actually handling this case, resulting in an Oops. Fix by disallowing datadir without lowerdir.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

6.13 ≤ v < 6.14.46.6.23 ≤ v < 6.6.886.7 ≤ v < 6.12.256.7 ≤ v < 6.14.46.7 ≤ v < 6.1524e16e385f2272b1a9df51337a5c32d28a29c7ad6.15 rc1 6.15 rc2 6.6.23 6.7cc0918b3582c98f12cfb30bf7496496d14bff3e9

Vendor states this is fixed in 0874b629f65320778e7e3e206177770666d9db18 (fixed)

Vendor states this is fixed in 21d2ffb0e9838a175064c22f3a9de97d1f56f27d (fixed)

Vendor states this is fixed in b9e3579213ba648fa23f780e8d53e99011c62331 (fixed)

Vendor states this is fixed in eb3a04a8516ee9b5174379306f94279fc90424c4 (fixed)

Vendor states this is fixed in 6.12.25 (unaffected)

Vendor states this is fixed in 6.14.4 (unaffected)

Vendor states this is fixed in 6.15 (unaffected)

Vendor states this is fixed in 6.6.88 (unaffected)

Vendor states this is fixed in 6.7 (unaffected)