Vulnerability-Lookup

UBUNTU-CVE-2025-40190 (CVE-2025-40190)

Vulnerability from osv_ubuntu – Published: 2025-11-12 22:15 – Updated: 2026-10-30 18:36 – Source website

Details

In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like: EXT4-fs error: EA inode ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117 Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode(). This prevents the underflow and the follow-on orphan/cleanup churn.

Severity

7.1 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      high

References

URL

Type

	https://ubuntu.com/security/CVE-2025-40190	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-40190	REPORT
	https://git.kernel.org/linus/57295e835408d8d425be…	REPORT
	https://git.kernel.org/stable/c/1cfb3e4ddbdc8e02e…	REPORT
	https://git.kernel.org/stable/c/3d6269028246f4484…	REPORT
	https://git.kernel.org/stable/c/440b003f449a4ff2a…	REPORT
	https://git.kernel.org/stable/c/505e69f76ac497e78…	REPORT
	https://git.kernel.org/stable/c/57295e835408d8d42…	REPORT
	https://git.kernel.org/stable/c/6b879c4c6bbaab03c…	REPORT
	https://git.kernel.org/stable/c/79ea7f3e11effe1bd…	REPORT
	https://git.kernel.org/stable/c/ea39e712c2f5ae148…	REPORT

JSON

To clipboard

Loading 1.0 MB of JSON…

CVE-2025-40190 (GCVE-0-2025-40190)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:56 – Updated: 2026-08-05 12:08

Title

ext4: guard against EA inode refcount underflow in xattr update

Summary

In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like: EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117 Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode(). This prevents the underflow and the follow-on orphan/cleanup churn.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6637 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ea39e712c2f5ae148…
https://git.kernel.org/stable/c/1cfb3e4ddbdc8e02e…
https://git.kernel.org/stable/c/505e69f76ac497e78…
https://git.kernel.org/stable/c/3d6269028246f4484…
https://git.kernel.org/stable/c/79ea7f3e11effe1bd…
https://git.kernel.org/stable/c/6b879c4c6bbaab03c…
https://git.kernel.org/stable/c/440b003f449a4ff2a…
https://git.kernel.org/stable/c/57295e835408d8d42…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ea39e712c2f5ae148ee5515798ae03523673e002 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 1cfb3e4ddbdc8e02e637b8852540bd4718bf4814 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 505e69f76ac497e788f4ea0267826ec7266b40c8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3d6269028246f4484bfed403c947a114bb583631 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 79ea7f3e11effe1bd9e753172981d9029133a278 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6b879c4c6bbaab03c0ad2a983953bd1410bb165e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 440b003f449a4ff2a00b08c8eab9ba5cd28f3943 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 57295e835408d8d425bef58da5253465db3d6888 (git) Affected: 0 , < 5.4.301 (semver) Affected: 0 , < 5.10.246 (semver) Affected: 0 , < 5.15.195 (semver) Affected: 0 , < 6.1.157 (semver) Affected: 0 , < 6.6.113 (semver) Affected: 0 , < 6.12.54 (semver) Affected: 0 , < 6.17.4 (semver)
Linux	Linux	Unaffected: 5.4.301 , ≤ 5.4.* (semver) Unaffected: 5.10.246 , ≤ 5.10.* (semver) Unaffected: 5.15.195 , ≤ 5.15.* (semver) Unaffected: 6.1.157 , ≤ 6.1.* (semver) Unaffected: 6.6.113 , ≤ 6.6.* (semver) Unaffected: 6.12.54 , ≤ 6.12.* (semver) Unaffected: 6.17.4 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea39e712c2f5ae148ee5515798ae03523673e002",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1cfb3e4ddbdc8e02e637b8852540bd4718bf4814",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "505e69f76ac497e788f4ea0267826ec7266b40c8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3d6269028246f4484bfed403c947a114bb583631",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "79ea7f3e11effe1bd9e753172981d9029133a278",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6b879c4c6bbaab03c0ad2a983953bd1410bb165e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "440b003f449a4ff2a00b08c8eab9ba5cd28f3943",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "57295e835408d8d425bef58da5253465db3d6888",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.301",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.246",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.195",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.157",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.113",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.54",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/xattr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.195",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.113",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: guard against EA inode refcount underflow in xattr update\n\nsyzkaller found a path where ext4_xattr_inode_update_ref() reads an EA\ninode refcount that is already \u003c= 0 and then applies ref_change (often\n-1). That lets the refcount underflow and we proceed with a bogus value,\ntriggering errors like:\n\n  EXT4-fs error: EA inode \u003cn\u003e ref underflow: ref_count=-1 ref_change=-1\n  EXT4-fs warning: ea_inode dec ref err=-117\n\nMake the invariant explicit: if the current refcount is non-positive,\ntreat this as on-disk corruption, emit ext4_error_inode(), and fail the\noperation with -EFSCORRUPTED instead of updating the refcount. Delete the\nWARN_ONCE() as negative refcounts are now impossible; keep error reporting\nin ext4_error_inode().\n\nThis prevents the underflow and the follow-on orphan/cleanup churn."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered when the kernel parses an attacker-crafted ext4 image, reached locally through mount (USB automount via udisks2, a loop-mounted image file, or a container/appliance filesystem image). ext4 lacks FS_USERNS_MOUNT so there is no remote or namespace-based path \u2014 the malicious data must be presented to a local block device.\nAC:L - The attacker fully controls the on-disk EA inode\u0027s ctime/i_version fields that encode the refcount, so setting it to 0 or negative and forcing a decrement is deterministic; syzbot has a reliable C reproducer that fires during mount-time orphan cleanup with no race or memory-layout dependency.\nPR:N - The attacker needs no account or privileges on the target system \u2014 they only supply the crafted filesystem image (e.g. a USB stick or downloaded disk image); the mount is performed by the victim\u0027s automounter or administrator.\nUI:R - A user or automounter on the victim system must mount the attacker-supplied ext4 image for the corrupted EA inode refcount to be parsed.\nS:U - The underflow, the resulting WARN/panic, and the filesystem-metadata corruption are all confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The underflow lets an EA inode be orphaned and freed while other inodes\u0027 xattr entries still reference it, so its inode number and data blocks are reallocated and later served through getxattr \u2014 and the Lustre-style path in ext4_xattr_inode_iget() bypasses ext4_xattr_inode_verify_hashes() entirely, allowing another file\u0027s contents to be disclosed.\nI:H - A bogus refcount (e.g. 0xFFFFFFFFFFFFFFFF) is written back to disk and clear_nlink()+ext4_orphan_add() is applied to an inode with i_nlink=2, deleting an inode that still has live directory entries and xattr references; ext4_xattr_inode_dec_ref_all() then decrements refcounts on reallocated inodes without hash validation, corrupting unrelated files\u0027 metadata and quota accounting.\nA:H - The path hits WARN_ONCE() in ext4_xattr_inode_update_ref(), which is a kernel panic under the widely deployed panic_on_warn setting, and the subsequent ext4 error either panics with errors=panic or forces the filesystem read-only, denying service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:26.693Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea39e712c2f5ae148ee5515798ae03523673e002"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cfb3e4ddbdc8e02e637b8852540bd4718bf4814"
        },
        {
          "url": "https://git.kernel.org/stable/c/505e69f76ac497e788f4ea0267826ec7266b40c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d6269028246f4484bfed403c947a114bb583631"
        },
        {
          "url": "https://git.kernel.org/stable/c/79ea7f3e11effe1bd9e753172981d9029133a278"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b879c4c6bbaab03c0ad2a983953bd1410bb165e"
        },
        {
          "url": "https://git.kernel.org/stable/c/440b003f449a4ff2a00b08c8eab9ba5cd28f3943"
        },
        {
          "url": "https://git.kernel.org/stable/c/57295e835408d8d425bef58da5253465db3d6888"
        }
      ],
      "title": "ext4: guard against EA inode refcount underflow in xattr update",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40190",
    "datePublished": "2025-11-12T21:56:30.914Z",
    "dateReserved": "2025-04-16T07:20:57.177Z",
    "dateUpdated": "2026-08-05T12:08:26.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted