CVE-2025-40190

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40190", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.177Z", "datePublished": "2025-11-12T21:56:30.914Z", "dateUpdated": "2026-08-05T12:08:26.693Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:26.693Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: guard against EA inode refcount underflow in xattr update\n\nsyzkaller found a path where ext4_xattr_inode_update_ref() reads an EA\ninode refcount that is already <= 0 and then applies ref_change (often\n-1). That lets the refcount underflow and we proceed with a bogus value,\ntriggering errors like:\n\n EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1\n EXT4-fs warning: ea_inode dec ref err=-117\n\nMake the invariant explicit: if the current refcount is non-positive,\ntreat this as on-disk corruption, emit ext4_error_inode(), and fail the\noperation with -EFSCORRUPTED instead of updating the refcount. Delete the\nWARN_ONCE() as negative refcounts are now impossible; keep error reporting\nin ext4_error_inode().\n\nThis prevents the underflow and the follow-on orphan/cleanup churn."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is triggered when the kernel parses an attacker-crafted ext4 image, reached locally through mount (USB automount via udisks2, a loop-mounted image file, or a container/appliance filesystem image). ext4 lacks FS_USERNS_MOUNT so there is no remote or namespace-based path \u2014 the malicious data must be presented to a local block device.\nAC:L - The attacker fully controls the on-disk EA inode's ctime/i_version fields that encode the refcount, so setting it to 0 or negative and forcing a decrement is deterministic; syzbot has a reliable C reproducer that fires during mount-time orphan cleanup with no race or memory-layout dependency.\nPR:N - The attacker needs no account or privileges on the target system \u2014 they only supply the crafted filesystem image (e.g. a USB stick or downloaded disk image); the mount is performed by the victim's automounter or administrator.\nUI:R - A user or automounter on the victim system must mount the attacker-supplied ext4 image for the corrupted EA inode refcount to be parsed.\nS:U - The underflow, the resulting WARN/panic, and the filesystem-metadata corruption are all confined to the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The underflow lets an EA inode be orphaned and freed while other inodes' xattr entries still reference it, so its inode number and data blocks are reallocated and later served through getxattr \u2014 and the Lustre-style path in ext4_xattr_inode_iget() bypasses ext4_xattr_inode_verify_hashes() entirely, allowing another file's contents to be disclosed.\nI:H - A bogus refcount (e.g. 0xFFFFFFFFFFFFFFFF) is written back to disk and clear_nlink()+ext4_orphan_add() is applied to an inode with i_nlink=2, deleting an inode that still has live directory entries and xattr references; ext4_xattr_inode_dec_ref_all() then decrements refcounts on reallocated inodes without hash validation, corrupting unrelated files' metadata and quota accounting.\nA:H - The path hits WARN_ONCE() in ext4_xattr_inode_update_ref(), which is a kernel panic under the widely deployed panic_on_warn setting, and the subsequent ext4 error either panics with errors=panic or forces the filesystem read-only, denying service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/xattr.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ea39e712c2f5ae148ee5515798ae03523673e002", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "1cfb3e4ddbdc8e02e637b8852540bd4718bf4814", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "505e69f76ac497e788f4ea0267826ec7266b40c8", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3d6269028246f4484bfed403c947a114bb583631", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "79ea7f3e11effe1bd9e753172981d9029133a278", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "6b879c4c6bbaab03c0ad2a983953bd1410bb165e", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "440b003f449a4ff2a00b08c8eab9ba5cd28f3943", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "57295e835408d8d425bef58da5253465db3d6888", "status": "affected", "versionType": "git"}, {"version": "0", "lessThan": "5.4.301", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "5.10.246", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "5.15.195", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.1.157", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.6.113", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.12.54", "status": "affected", "versionType": "semver"}, {"version": "0", "lessThan": "6.17.4", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ext4/xattr.c"], "versions": [{"version": "5.4.301", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.246", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.195", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.157", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.113", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.54", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.4", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.4.301"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.10.246"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.15.195"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.1.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.6.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.17.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ea39e712c2f5ae148ee5515798ae03523673e002"}, {"url": "https://git.kernel.org/stable/c/1cfb3e4ddbdc8e02e637b8852540bd4718bf4814"}, {"url": "https://git.kernel.org/stable/c/505e69f76ac497e788f4ea0267826ec7266b40c8"}, {"url": "https://git.kernel.org/stable/c/3d6269028246f4484bfed403c947a114bb583631"}, {"url": "https://git.kernel.org/stable/c/79ea7f3e11effe1bd9e753172981d9029133a278"}, {"url": "https://git.kernel.org/stable/c/6b879c4c6bbaab03c0ad2a983953bd1410bb165e"}, {"url": "https://git.kernel.org/stable/c/440b003f449a4ff2a00b08c8eab9ba5cd28f3943"}, {"url": "https://git.kernel.org/stable/c/57295e835408d8d425bef58da5253465db3d6888"}], "title": "ext4: guard against EA inode refcount underflow in xattr update", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ext4/xattr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ea39e712c2f5ae148ee5515798ae03523673e002", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "1cfb3e4ddbdc8e02e637b8852540bd4718bf4814", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "505e69f76ac497e788f4ea0267826ec7266b40c8", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "3d6269028246f4484bfed403c947a114bb583631", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "79ea7f3e11effe1bd9e753172981d9029133a278", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "6b879c4c6bbaab03c0ad2a983953bd1410bb165e", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "440b003f449a4ff2a00b08c8eab9ba5cd28f3943", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "57295e835408d8d425bef58da5253465db3d6888", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "5.4.301", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "5.10.246", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "5.15.195", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.1.157", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.6.113", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.12.54", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "6.17.4", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ext4/xattr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.301", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.246", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.195", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.157", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.113", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.54", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: guard against EA inode refcount underflow in xattr update\n\nsyzkaller found a path where ext4_xattr_inode_update_ref() reads an EA\ninode refcount that is already <= 0 and then applies ref_change (often\n-1). That lets the refcount underflow and we proceed with a bogus value,\ntriggering errors like:\n\n EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1\n EXT4-fs warning: ea_inode dec ref err=-117\n\nMake the invariant explicit: if the current refcount is non-positive,\ntreat this as on-disk corruption, emit ext4_error_inode(), and fail the\noperation with -EFSCORRUPTED instead of updating the refcount. Delete the\nWARN_ONCE() as negative refcounts are now impossible; keep error reporting\nin ext4_error_inode().\n\nThis prevents the underflow and the follow-on orphan/cleanup churn."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: protecci\u00f3n contra el desbordamiento negativo del contador de referencias del inodo EA en la actualizaci\u00f3n de xattr\n\nsyzkaller encontr\u00f3 una ruta donde ext4_xattr_inode_update_ref() lee un contador de referencias del inodo EA que ya es menor o igual que 0 y luego aplica ref_change (a menudo -1). Esto permite el desbordamiento negativo del contador de referencias y se procede con un valor err\u00f3neo, desencadenando errores como:\n\n EXT4-fs error: EA inode <n> desbordamiento negativo de ref: ref_count=-1 ref_change=-1\n EXT4-fs warning: ea_inode dec ref err=-117\n\nHacer expl\u00edcito el invariante: si el contador de referencias actual no es positivo, tratar esto como corrupci\u00f3n en disco, emitir ext4_error_inode(), y fallar la operaci\u00f3n con -EFSCORRUPTED en lugar de actualizar el contador de referencias. Eliminar el WARN_ONCE() ya que los contadores de referencias negativos son ahora imposibles; mantener el informe de errores en ext4_error_inode().\n\nEsto previene el desbordamiento negativo y la posterior agitaci\u00f3n de hu\u00e9rfanos/limpieza."}], "id": "CVE-2025-40190", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-11-12T22:15:45.960", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1cfb3e4ddbdc8e02e637b8852540bd4718bf4814"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3d6269028246f4484bfed403c947a114bb583631"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/440b003f449a4ff2a00b08c8eab9ba5cd28f3943"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/505e69f76ac497e788f4ea0267826ec7266b40c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57295e835408d8d425bef58da5253465db3d6888"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b879c4c6bbaab03c0ad2a983953bd1410bb165e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79ea7f3e11effe1bd9e753172981d9029133a278"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea39e712c2f5ae148ee5515798ae03523673e002"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: ext4: guard against EA inode refcount underflow in xattr update", "id": "2414732", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414732"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40190", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40190\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40190\nhttps://lore.kernel.org/linux-cve-announce/2025111244-CVE-2025-40190-b6bc@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-11-13T09:52:30.349651+00:00", "updated": "2025-11-13T09:52:30.349677+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}