CVE-2025-21896: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel was identified and assigned CVE-2025-21896, relating to the FUSE (Filesystem in Userspace) component. The issue was discovered and reported on December 29, 2024, involving a use-after-free (UAF) bug in the file system's readahead functionality (CVE Mitre).

The vulnerability arose from changes in commit 3eab9d7bc2f4 which converted the FUSE readahead logic to use new folio readahead code. The modification caused the code to drop the reference on the folio once locked, using an inferred reference instead of maintaining the reference for the entire duration of the readpages call. This created a use-after-free condition specifically in cases involving splice pipe responses where the old folio is removed and a new folio is spliced in (NVD).

The vulnerability could lead to a use-after-free condition in the Linux kernel's FUSE implementation, potentially affecting system stability and security. The issue specifically impacts the file system's readahead functionality, which could affect system performance and reliability (Debian Tracker).

The issue has been resolved by reverting back to __readahead_folio() implementation, which maintains the reference on the folio throughout the readpages duration until either the reference is explicitly dropped in fuse_readpages_end() or after replacement in the page cache for splice cases. Fixed versions are available in various Linux distributions, including Debian Bullseye (5.10.234-1), Bookworm (6.1.133-1), and Trixie (6.12.21-1) (Debian Tracker).