{"id":"CVE-2025-22121","state":"PUBLISHED","title":"ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()\n\nThere's issue as follows:\nBUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790\nRead of size 4 at addr ffff88807b003000 by task syz-executor.0/15172\n\nCPU: 3 PID: 15172 Comm: syz-executor.0\nCall Trace:\n __dump_stack lib/dump_stack.c:82 [inline]\n dump_stack+0xbe/0xfd lib/dump_stack.c:123\n print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400\n __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560\n kasan_report+0x3a/0x50 mm/kasan/report.c:585\n ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137\n ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896\n ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323\n evict+0x39f/0x880 fs/inode.c:622\n iput_final fs/inode.c:1746 [inline]\n iput fs/inode.c:1772 [inline]\n iput+0x525/0x6c0 fs/inode.c:1758\n ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]\n ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300\n mount_bdev+0x355/0x410 fs/super.c:1446\n legacy_get_tree+0xfe/0x220 fs/fs_context.c:611\n vfs_get_tree+0x8d/0x2f0 fs/super.c:1576\n do_new_mount fs/namespace.c:2983 [inline]\n path_mount+0x119a/0x1ad0 fs/namespace.c:3316\n do_mount+0xfc/0x110 fs/namespace.c:3329\n __do_sys_mount fs/namespace.c:3540 [inline]\n __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nMemory state around the buggy address:\n ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                   ^\n ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\nAbove issue happens as ext4_xattr_delete_inode() isn't check xattr\nis valid if xattr is in inode.\nTo solve above issue call xattr_check_inode() check if xattr if valid\nin inode. In fact, we can directly verify in ext4_iget_extra_inode(),\nso that there is no divergent verification.","publishedAt":"2025-04-16T14:13:05.894Z","updatedAt":"2026-10-15T21:51:57.982Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"27202452b0bc942fdc3db72a44c4dcdab96d5b56","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"b374e9ecc92aaa7fb2ab221ee3ff5451118ab566","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"c000a8a9b5343a5ef867df173c6349672dacbd0f","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"3c591353956ffcace2cc74d09930774afed60619","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"098927a13fd918bd7c64c2de905350a1ad7b4a3a","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"5701875f9609b000d91351eaa6bfd97fe2f157f4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/inode.c","fs/ext4/xattr.c","fs/ext4/xattr.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.13","versionType":"semver"},{"version":"5.10.248","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.198","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.161","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.120","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.59","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.2","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/inode.c","fs/ext4/xattr.c","fs/ext4/xattr.h"]}],"references":["https://git.kernel.org/stable/c/27202452b0bc942fdc3db72a44c4dcdab96d5b56","https://git.kernel.org/stable/c/b374e9ecc92aaa7fb2ab221ee3ff5451118ab566","https://git.kernel.org/stable/c/c000a8a9b5343a5ef867df173c6349672dacbd0f","https://git.kernel.org/stable/c/3c591353956ffcace2cc74d09930774afed60619","https://git.kernel.org/stable/c/098927a13fd918bd7c64c2de905350a1ad7b4a3a","https://git.kernel.org/stable/c/0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8","https://git.kernel.org/stable/c/5701875f9609b000d91351eaa6bfd97fe2f157f4","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/22xxx/CVE-2025-22121.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-22121","state":"PUBLISHED","datePublished":"2025-04-16T14:13:05.894Z","dateUpdated":"2026-10-15T21:51:57.982Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-29T08:45:45.823Z"},"containers":{"cna":{"title":"ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()\n\nThere's issue as follows:\nBUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790\nRead of size 4 at addr ffff88807b003000 by task syz-executor.0/15172\n\nCPU: 3 PID: 15172 Comm: syz-executor.0\nCall Trace:\n __dump_stack lib/dump_stack.c:82 [inline]\n dump_stack+0xbe/0xfd lib/dump_stack.c:123\n print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400\n __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560\n kasan_report+0x3a/0x50 mm/kasan/report.c:585\n ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137\n ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896\n ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323\n evict+0x39f/0x880 fs/inode.c:622\n iput_final fs/inode.c:1746 [inline]\n iput fs/inode.c:1772 [inline]\n iput+0x525/0x6c0 fs/inode.c:1758\n ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]\n ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300\n mount_bdev+0x355/0x410 fs/super.c:1446\n legacy_get_tree+0xfe/0x220 fs/fs_context.c:611\n vfs_get_tree+0x8d/0x2f0 fs/super.c:1576\n do_new_mount fs/namespace.c:2983 [inline]\n path_mount+0x119a/0x1ad0 fs/namespace.c:3316\n do_mount+0xfc/0x110 fs/namespace.c:3329\n __do_sys_mount fs/namespace.c:3540 [inline]\n __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nMemory state around the buggy address:\n ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                   ^\n ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\nAbove issue happens as ext4_xattr_delete_inode() isn't check xattr\nis valid if xattr is in inode.\nTo solve above issue call xattr_check_inode() check if xattr if valid\nin inode. In fact, we can directly verify in ext4_iget_extra_inode(),\nso that there is no divergent verification."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"27202452b0bc942fdc3db72a44c4dcdab96d5b56","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"b374e9ecc92aaa7fb2ab221ee3ff5451118ab566","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"c000a8a9b5343a5ef867df173c6349672dacbd0f","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"3c591353956ffcace2cc74d09930774afed60619","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"098927a13fd918bd7c64c2de905350a1ad7b4a3a","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8","versionType":"git"},{"version":"e50e5129f384ae282adebfb561189cdb19b81cee","status":"affected","lessThan":"5701875f9609b000d91351eaa6bfd97fe2f157f4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/inode.c","fs/ext4/xattr.c","fs/ext4/xattr.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.13","versionType":"semver"},{"version":"5.10.248","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.198","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.161","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.120","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.59","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.2","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/inode.c","fs/ext4/xattr.c","fs/ext4/xattr.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/27202452b0bc942fdc3db72a44c4dcdab96d5b56"},{"url":"https://git.kernel.org/stable/c/b374e9ecc92aaa7fb2ab221ee3ff5451118ab566"},{"url":"https://git.kernel.org/stable/c/c000a8a9b5343a5ef867df173c6349672dacbd0f"},{"url":"https://git.kernel.org/stable/c/3c591353956ffcace2cc74d09930774afed60619"},{"url":"https://git.kernel.org/stable/c/098927a13fd918bd7c64c2de905350a1ad7b4a3a"},{"url":"https://git.kernel.org/stable/c/0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8"},{"url":"https://git.kernel.org/stable/c/5701875f9609b000d91351eaa6bfd97fe2f157f4"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires the attacker-crafted ext4 image to be presented to the local kernel as a block device — a USB stick on an automounting desktop/kiosk, a loop/NBD/iSCSI-backed device, or a container/VM disk image — reaching the bug through the mount(2) syscall path. No network protocol handler is involved, and physical access is not strictly required since loop and network-block-backed images work equally well.\nAC:L - The attacker fully controls every byte of the on-disk image, including the ea_inode feature bit, the inode's i_extra_isize, the xattr magic, the entry array, and which inode sits last in its inode-table block so the walk runs off the end of the buffer_head page allocation. The corruption is deterministic at mount during orphan cleanup with no race to win and no dependency on kernel memory layout the attacker cannot influence.\nPR:N - The attacker needs no account or privilege on the target system — they only supply the malicious filesystem image, which is then mounted by root, by an automount daemon such as udisks2, or by a container/VM image-handling service acting on the attacker's data. All privileged operations along the path are performed by the victim system on the attacker's behalf.\nUI:N - On the common desktop, kiosk, and appliance configurations where udisks2/systemd automounts removable media, plugging in the device triggers the mount with no human participation, and the bug fires immediately during ext4_orphan_cleanup() inside ext4_fill_super() rather than requiring any subsequent file access. Container and VM image-mount services likewise mount attacker-supplied images unattended.\nS:U - The out-of-bounds read and write occur in kernel heap memory within the same kernel security authority that hosts the vulnerable ext4 code. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The loop performs an unbounded (pre-mitigation) or several-byte-past-the-allocation (post-mitigation) out-of-bounds read of adjacent kernel heap memory past the inode-table buffer_head, and those leaked bytes are consumed as e_value_inum/e_hash/e_value_size values that steer subsequent inode lookups and quota accounting, making adjacent kernel memory contents observable through filesystem state and error output.\nI:H - `entry->e_value_inum = 0; entry->e_value_size = 0;` writes 8 zero bytes through an out-of-bounds entry pointer into adjacent kernel heap memory, and the OOB-derived inode numbers drive ext4_xattr_inode_dec_ref()/ext4_orphan_add() to decrement refcounts and orphan arbitrary inodes. This combination of controlled kernel heap zeroing plus arbitrary on-disk metadata corruption is a usable memory-corruption primitive, not a bounded misread.\nA:H - KASAN reproduces the issue as a use-after-free/out-of-bounds access past a page-sized buffer_head allocation during mount; on a production kernel the same access corrupts adjacent slab memory and the bogus inode ref-count decrements trigger EXT4-fs errors and oops/panic. The crash occurs during ext4_fill_super() and can be repeated on every mount attempt."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:56:56.499Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.10.248"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.15.198"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.1.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.6.120"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.12.59"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.14.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.15"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:05:39.351Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-22121","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:44:31.080003Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:51:57.982Z"}}]}}}