Skip to content
Heist/ feed
High

ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() There's issue as follows: BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790 Read of size 4 at addr ffff88807b003000 by task syz-executor.0/15172 CPU: 3 PID: 15172 Comm: syz-executor.0 Call Trace: __dump_stack lib/dump_stack.c:82 [inline] dump_stack+0xbe/0xfd lib/dump_stack.c:123 print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400 __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560 kasan_report+0x3a/0x50 mm/kasan/report.c:585 ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137 ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896 ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323 evict+0x39f/0x880 fs/inode.c:622 iput_final fs/inode.c:1746 [inline] iput fs/inode.c:1772 [inline] iput+0x525/0x6c0 fs/inode.c:1758 ext4_orphan_cleanup fs/ext4/super.c:3298 [inline] ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300 mount_bdev+0x355/0x410 fs/super.c:1446 legacy_get_tree+0xfe/0x220 fs/fs_context.c:611 vfs_get_tree+0x8d/0x2f0 fs/super.c:1576 do_new_mount fs/namespace.c:2983 [inline] path_mount+0x119a/0x1ad0 fs/namespace.c:3316 do_mount+0xfc/0x110 fs/namespace.c:3329 __do_sys_mount fs/namespace.c:3540 [inline] __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Memory state around the buggy address: ffff88807b002f00: 00 00

Announced Source revision 1
Original source ↗

CVE-2025-22121

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-22121

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
        "lessThan": "27202452b0bc942fdc3db72a44c4dcdab96d5b56",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
        "lessThan": "b374e9ecc92aaa7fb2ab221ee3ff5451118ab566",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
        "lessThan": "c000a8a9b5343a5ef867df173c6349672dacbd0f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
        "lessThan": "3c591353956ffcace2cc74d09930774afed60619",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
        "lessThan": "098927a13fd918bd7c64c2de905350a1ad7b4a3a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
        "lessThan": "0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "e50e5129f384ae282adebfb561189cdb19b81cee",
        "lessThan": "5701875f9609b000d91351eaa6bfd97fe2f157f4",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/ext4/inode.c",
      "fs/ext4/xattr.c",
      "fs/ext4/xattr.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.13"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.13",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.248",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.198",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.161",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.120",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.59",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.14.2",
        "versionType": "semver",
        "lessThanOrEqual": "6.14.*"
      },
      {
        "status": "unaffected",
        "version": "6.15",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/ext4/inode.c",
      "fs/ext4/xattr.c",
      "fs/ext4/xattr.h"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-22121

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30461 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement