CVE-2025-40167

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40167", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.176Z", "datePublished": "2025-11-12T10:26:24.498Z", "dateUpdated": "2026-10-15T22:02:39.184Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:12.384Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: detect invalid INLINE_DATA + EXTENTS flag combination\n\nsyzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity\nfile on a corrupted ext4 filesystem mounted without a journal.\n\nThe issue is that the filesystem has an inode with both the INLINE_DATA\nand EXTENTS flags set:\n\n EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:\n comm syz.0.17: corrupted extent tree: lblk 0 < prev 66\n\nInvestigation revealed that the inode has both flags set:\n DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1\n\nThis is an invalid combination since an inode should have either:\n- INLINE_DATA: data stored directly in the inode\n- EXTENTS: data stored in extent-mapped blocks\n\nHaving both flags causes ext4_has_inline_data() to return true, skipping\nextent tree validation in __ext4_iget(). The unvalidated out-of-order\nextents then trigger a BUG_ON in ext4_es_cache_extent() due to integer\nunderflow when calculating hole sizes.\n\nFix this by detecting this invalid flag combination early in ext4_iget()\nand rejecting the corrupted inode."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The invalid flag combination can only be delivered on a crafted ext4 on-disk image attached locally (USB stick, SD card, loop-mounted file), and the bug fires during `ext4_iget()`/`ext4_map_blocks()` on the local mount; there is no network-facing input into this code path.\nAC:L - The attacker fully controls the image and merely sets both INLINE_DATA_FL and EXTENTS_FL on an inode with a `system.data` xattr, formatting without a journal \u2014 this deterministically bypasses `ext4_ext_check_inode()` and trips `BUG_ON(end < lblk)` on every open, with no race, timing, or memory-layout condition outside the attacker's control.\nPR:N - The attacker needs no account or privilege on the target \u2014 they only supply the malicious filesystem image, and the privileged mount plus the subsequent file access are performed by the victim, an indexer/thumbnailer, or an automounter such as udisks2 or vold.\nUI:R - Because `ext4_fs_type` lacks `FS_USERNS_MOUNT` and `INLINE_DATA_FL` is not in `EXT4_FL_USER_MODIFIABLE`, the corrupt inode cannot be created on a live filesystem; a user or automounter must actually mount the attacker-supplied ext4 image.\nS:U - The out-of-bounds accesses and the panic are confined to the mounting host's kernel memory and its own filesystem, within a single security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Skipping `__ext4_ext_check()` leaves `eh_entries` unvalidated (up to 65535 versus the 4 that fit in the 60-byte `i_block[]`), so `ext4_cache_extents()` and `ext4_ext_binsearch()` read hundreds of kilobytes past the `ext4_inode_info` slab object, and those out-of-bounds kernel bytes are interpreted as physical block numbers that drive real disk reads and are reported back to userspace through FIEMAP.\nI:H - The unvalidated `eh_max` defeats the `eh_entries >= eh_max` guard in `ext4_ext_insert_extent()`, so extent entries are memmoved and written past the end of `i_block[]` into adjacent `ext4_inode_info` slab fields, giving a heap out-of-bounds write; the missing `ext4_valid_extent()`/`ext4_inode_block_valid()` check additionally lets writes and block frees land on superblock, bitmap, and group-descriptor blocks.\nA:H - The out-of-order extents produce an integer underflow in `lblk - prev` and hit `BUG_ON(end < lblk)` in `ext4_es_cache_extent()`, an immediate and reliably reproducible kernel panic on every access to the crafted file; the out-of-bounds slab reads independently oops the kernel on KASAN and hardened builds."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/inode.c"], "versions": [{"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "4954d297c91d292630ab43ba4d195dc371ce65d3", "status": "affected", "versionType": "git"}, {"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "f061f7c331fc16250fc82aa68964f35821687217", "status": "affected", "versionType": "git"}, {"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "2e9e10657b04152ed0d6ecae8d0c02a3405e28f5", "status": "affected", "versionType": "git"}, {"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "1437c95ab2a28b138d4521653583729f61ccb48b", "status": "affected", "versionType": "git"}, {"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "cb6039b68efa547b676a8a10fc4618d9d1865c23", "status": "affected", "versionType": "git"}, {"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "de985264eef64be8a90595908f2e6a87946dad34", "status": "affected", "versionType": "git"}, {"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "1f5ccd22ff482639133f2a0fe08f6d19d0e68717", "status": "affected", "versionType": "git"}, {"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "1d3ad183943b38eec2acf72a0ae98e635dc8456b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/inode.c"], "versions": [{"version": "3.8", "status": "affected"}, {"version": "0", "lessThan": "3.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.196", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.158", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.114", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.55", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.5", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.4.301"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.10.246"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "5.15.196"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.1.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.6.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.12.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.17.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.8", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4954d297c91d292630ab43ba4d195dc371ce65d3"}, {"url": "https://git.kernel.org/stable/c/f061f7c331fc16250fc82aa68964f35821687217"}, {"url": "https://git.kernel.org/stable/c/2e9e10657b04152ed0d6ecae8d0c02a3405e28f5"}, {"url": "https://git.kernel.org/stable/c/1437c95ab2a28b138d4521653583729f61ccb48b"}, {"url": "https://git.kernel.org/stable/c/cb6039b68efa547b676a8a10fc4618d9d1865c23"}, {"url": "https://git.kernel.org/stable/c/de985264eef64be8a90595908f2e6a87946dad34"}, {"url": "https://git.kernel.org/stable/c/1f5ccd22ff482639133f2a0fe08f6d19d0e68717"}, {"url": "https://git.kernel.org/stable/c/1d3ad183943b38eec2acf72a0ae98e635dc8456b"}], "title": "ext4: detect invalid INLINE_DATA + EXTENTS flag combination", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:26.297320Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:39.184Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:57:26.297320Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:57:27.274Z"}}], "cna": {"title": "ext4: detect invalid INLINE_DATA + EXTENTS flag combination", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The invalid flag combination can only be delivered on a crafted ext4 on-disk image attached locally (USB stick, SD card, loop-mounted file), and the bug fires during `ext4_iget()`/`ext4_map_blocks()` on the local mount; there is no network-facing input into this code path.\nAC:L - The attacker fully controls the image and merely sets both INLINE_DATA_FL and EXTENTS_FL on an inode with a `system.data` xattr, formatting without a journal \u2014 this deterministically bypasses `ext4_ext_check_inode()` and trips `BUG_ON(end < lblk)` on every open, with no race, timing, or memory-layout condition outside the attacker's control.\nPR:N - The attacker needs no account or privilege on the target \u2014 they only supply the malicious filesystem image, and the privileged mount plus the subsequent file access are performed by the victim, an indexer/thumbnailer, or an automounter such as udisks2 or vold.\nUI:R - Because `ext4_fs_type` lacks `FS_USERNS_MOUNT` and `INLINE_DATA_FL` is not in `EXT4_FL_USER_MODIFIABLE`, the corrupt inode cannot be created on a live filesystem; a user or automounter must actually mount the attacker-supplied ext4 image.\nS:U - The out-of-bounds accesses and the panic are confined to the mounting host's kernel memory and its own filesystem, within a single security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Skipping `__ext4_ext_check()` leaves `eh_entries` unvalidated (up to 65535 versus the 4 that fit in the 60-byte `i_block[]`), so `ext4_cache_extents()` and `ext4_ext_binsearch()` read hundreds of kilobytes past the `ext4_inode_info` slab object, and those out-of-bounds kernel bytes are interpreted as physical block numbers that drive real disk reads and are reported back to userspace through FIEMAP.\nI:H - The unvalidated `eh_max` defeats the `eh_entries >= eh_max` guard in `ext4_ext_insert_extent()`, so extent entries are memmoved and written past the end of `i_block[]` into adjacent `ext4_inode_info` slab fields, giving a heap out-of-bounds write; the missing `ext4_valid_extent()`/`ext4_inode_block_valid()` check additionally lets writes and block frees land on superblock, bitmap, and group-descriptor blocks.\nA:H - The out-of-order extents produce an integer underflow in `lblk - prev` and hit `BUG_ON(end < lblk)` in `ext4_es_cache_extent()`, an immediate and reliably reproducible kernel panic on every access to the crafted file; the out-of-bounds slab reads independently oops the kernel on KASAN and hardened builds."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "4954d297c91d292630ab43ba4d195dc371ce65d3", "versionType": "git"}, {"status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "f061f7c331fc16250fc82aa68964f35821687217", "versionType": "git"}, {"status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "2e9e10657b04152ed0d6ecae8d0c02a3405e28f5", "versionType": "git"}, {"status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "1437c95ab2a28b138d4521653583729f61ccb48b", "versionType": "git"}, {"status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "cb6039b68efa547b676a8a10fc4618d9d1865c23", "versionType": "git"}, {"status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "de985264eef64be8a90595908f2e6a87946dad34", "versionType": "git"}, {"status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "1f5ccd22ff482639133f2a0fe08f6d19d0e68717", "versionType": "git"}, {"status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "lessThan": "1d3ad183943b38eec2acf72a0ae98e635dc8456b", "versionType": "git"}], "programFiles": ["fs/ext4/inode.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.8"}, {"status": "unaffected", "version": "0", "lessThan": "3.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.301", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.246", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.196", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.158", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.114", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.55", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.5", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ext4/inode.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4954d297c91d292630ab43ba4d195dc371ce65d3"}, {"url": "https://git.kernel.org/stable/c/f061f7c331fc16250fc82aa68964f35821687217"}, {"url": "https://git.kernel.org/stable/c/2e9e10657b04152ed0d6ecae8d0c02a3405e28f5"}, {"url": "https://git.kernel.org/stable/c/1437c95ab2a28b138d4521653583729f61ccb48b"}, {"url": "https://git.kernel.org/stable/c/cb6039b68efa547b676a8a10fc4618d9d1865c23"}, {"url": "https://git.kernel.org/stable/c/de985264eef64be8a90595908f2e6a87946dad34"}, {"url": "https://git.kernel.org/stable/c/1f5ccd22ff482639133f2a0fe08f6d19d0e68717"}, {"url": "https://git.kernel.org/stable/c/1d3ad183943b38eec2acf72a0ae98e635dc8456b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: detect invalid INLINE_DATA + EXTENTS flag combination\n\nsyzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity\nfile on a corrupted ext4 filesystem mounted without a journal.\n\nThe issue is that the filesystem has an inode with both the INLINE_DATA\nand EXTENTS flags set:\n\n EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:\n comm syz.0.17: corrupted extent tree: lblk 0 < prev 66\n\nInvestigation revealed that the inode has both flags set:\n DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1\n\nThis is an invalid combination since an inode should have either:\n- INLINE_DATA: data stored directly in the inode\n- EXTENTS: data stored in extent-mapped blocks\n\nHaving both flags causes ext4_has_inline_data() to return true, skipping\nextent tree validation in __ext4_iget(). The unvalidated out-of-order\nextents then trigger a BUG_ON in ext4_es_cache_extent() due to integer\nunderflow when calculating hole sizes.\n\nFix this by detecting this invalid flag combination early in ext4_iget()\nand rejecting the corrupted inode."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.301", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.246", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.196", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.158", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.114", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.55", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.5", "versionStartIncluding": "3.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "3.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:12.384Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40167", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:39.184Z", "dateReserved": "2025-04-16T07:20:57.176Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-11-12T10:26:24.498Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ext4/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4954d297c91d292630ab43ba4d195dc371ce65d3", "status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "versionType": "git"}, {"lessThan": "f061f7c331fc16250fc82aa68964f35821687217", "status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "versionType": "git"}, {"lessThan": "2e9e10657b04152ed0d6ecae8d0c02a3405e28f5", "status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "versionType": "git"}, {"lessThan": "1437c95ab2a28b138d4521653583729f61ccb48b", "status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "versionType": "git"}, {"lessThan": "cb6039b68efa547b676a8a10fc4618d9d1865c23", "status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "versionType": "git"}, {"lessThan": "de985264eef64be8a90595908f2e6a87946dad34", "status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "versionType": "git"}, {"lessThan": "1f5ccd22ff482639133f2a0fe08f6d19d0e68717", "status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "versionType": "git"}, {"lessThan": "1d3ad183943b38eec2acf72a0ae98e635dc8456b", "status": "affected", "version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ext4/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.8"}, {"lessThan": "3.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.301", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.246", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.196", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.158", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.114", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.55", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: detect invalid INLINE_DATA + EXTENTS flag combination\n\nsyzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity\nfile on a corrupted ext4 filesystem mounted without a journal.\n\nThe issue is that the filesystem has an inode with both the INLINE_DATA\nand EXTENTS flags set:\n\n EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:\n comm syz.0.17: corrupted extent tree: lblk 0 < prev 66\n\nInvestigation revealed that the inode has both flags set:\n DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1\n\nThis is an invalid combination since an inode should have either:\n- INLINE_DATA: data stored directly in the inode\n- EXTENTS: data stored in extent-mapped blocks\n\nHaving both flags causes ext4_has_inline_data() to return true, skipping\nextent tree validation in __ext4_iget(). The unvalidated out-of-order\nextents then trigger a BUG_ON in ext4_es_cache_extent() due to integer\nunderflow when calculating hole sizes.\n\nFix this by detecting this invalid flag combination early in ext4_iget()\nand rejecting the corrupted inode."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: detectar combinaci\u00f3n inv\u00e1lida de las banderas INLINE_DATA + EXTENTS\n\nsyzbot inform\u00f3 un BUG_ON en ext4_es_cache_extent() al abrir un archivo verity en un sistema de archivos ext4 corrupto montado sin un journal.\n\nEl problema es que el sistema de archivos tiene un inodo con las banderas INLINE_DATA y EXTENTS ambas establecidas:\n\n Error de EXT4-fs (dispositivo loop0): ext4_cache_extents:545: inodo #15:\n comm syz.0.17: \u00e1rbol de extents corrupto: lblk 0 < prev 66\n\nLa investigaci\u00f3n revel\u00f3 que el inodo tiene ambas banderas establecidas:\n DEBUG: inodo 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1\n\nEsta es una combinaci\u00f3n inv\u00e1lida ya que un inodo deber\u00eda tener una de las siguientes:\n- INLINE_DATA: datos almacenados directamente en el inodo\n- EXTENTS: datos almacenados en bloques mapeados por extents\n\nTener ambas banderas hace que ext4_has_inline_data() devuelva verdadero, salt\u00e1ndose la validaci\u00f3n del \u00e1rbol de extents en __ext4_iget(). Los extents no validados y fuera de orden entonces disparan un BUG_ON en ext4_es_cache_extent() debido a un desbordamiento negativo de enteros al calcular los tama\u00f1os de los huecos.\n\nEsto se soluciona detectando esta combinaci\u00f3n de banderas inv\u00e1lida temprano en ext4_iget() y rechazando el inodo corrupto."}], "id": "CVE-2025-40167", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40167", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:57:26.297320Z", "version": "2.0.3"}}]}, "published": "2025-11-12T11:15:47.013", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1437c95ab2a28b138d4521653583729f61ccb48b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d3ad183943b38eec2acf72a0ae98e635dc8456b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1f5ccd22ff482639133f2a0fe08f6d19d0e68717"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e9e10657b04152ed0d6ecae8d0c02a3405e28f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4954d297c91d292630ab43ba4d195dc371ce65d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cb6039b68efa547b676a8a10fc4618d9d1865c23"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/de985264eef64be8a90595908f2e6a87946dad34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f061f7c331fc16250fc82aa68964f35821687217"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: ext4: detect invalid INLINE_DATA + EXTENTS flag combination", "id": "2414476", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414476"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\next4: detect invalid INLINE_DATA + EXTENTS flag combination\nsyzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity\nfile on a corrupted ext4 filesystem mounted without a journal.\nThe issue is that the filesystem has an inode with both the INLINE_DATA\nand EXTENTS flags set:\nEXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:\ncomm syz.0.17: corrupted extent tree: lblk 0 < prev 66\nInvestigation revealed that the inode has both flags set:\nDEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1\nThis is an invalid combination since an inode should have either:\n- INLINE_DATA: data stored directly in the inode\n- EXTENTS: data stored in extent-mapped blocks\nHaving both flags causes ext4_has_inline_data() to return true, skipping\nextent tree validation in __ext4_iget(). The unvalidated out-of-order\nextents then trigger a BUG_ON in ext4_es_cache_extent() due to integer\nunderflow when calculating hole sizes.\nFix this by detecting this invalid flag combination early in ext4_iget()\nand rejecting the corrupted inode."], "name": "CVE-2025-40167", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40167\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40167\nhttps://lore.kernel.org/linux-cve-announce/2025111228-CVE-2025-40167-184f@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-12T22:12:53.465978+00:00", "updated": "2025-11-12T22:12:53.466003+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}