{"id":"CVE-2025-22121","revision":"170a04ce4ddf40bd91148412afd63373","records":[{"revision":"170a04ce4ddf40bd91148412afd63373","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-22121","aliases":[],"title":"ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()\n\nThere's issue as follows:\nBUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790\nRead of size 4 at addr ffff88807b003000 by task syz-executor.0/15172\n\nCPU: 3 PID: 15172 Comm: syz-executor.0\nCall Trace:\n __dump_stack lib/dump_stack.c:82 [inline]\n dump_stack+0xbe/0xfd lib/dump_stack.c:123\n print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400\n __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560\n kasan_report+0x3a/0x50 mm/kasan/report.c:585\n ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137\n ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896\n ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323\n evict+0x39f/0x880 fs/inode.c:622\n iput_final fs/inode.c:1746 [inline]\n iput fs/inode.c:1772 [inline]\n iput+0x525/0x6c0 fs/inode.c:1758\n ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]\n ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300\n mount_bdev+0x355/0x410 fs/super.c:1446\n legacy_get_tree+0xfe/0x220 fs/fs_context.c:611\n vfs_get_tree+0x8d/0x2f0 fs/super.c:1576\n do_new_mount fs/namespace.c:2983 [inline]\n path_mount+0x119a/0x1ad0 fs/namespace.c:3316\n do_mount+0xfc/0x110 fs/namespace.c:3329\n __do_sys_mount fs/namespace.c:3540 [inline]\n __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514\n do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n\nMemory state around the buggy address:\n ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n                   ^\n ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n\nAbove issue happens as ext4_xattr_delete_inode() isn't check xattr\nis valid if xattr is in inode.\nTo solve above issue call xattr_check_inode() check if xattr if valid\nin inode. In fact, we can directly verify in ext4_iget_extra_inode(),\nso that there is no divergent verification.","state":0,"publishedAt":"2025-04-16T14:13:05.894+00:00","modifiedAt":"2026-10-15T21:51:57.982+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ext4/inode.c\",\n                        \"fs/ext4/xattr.c\",\n                        \"fs/ext4/xattr.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\",\n                            \"lessThan\": \"27202452b0bc942fdc3db72a44c4dcdab96d5b56\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\",\n                            \"lessThan\": \"b374e9ecc92aaa7fb2ab221ee3ff5451118ab566\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\",\n                            \"lessThan\": \"c000a8a9b5343a5ef867df173c6349672dacbd0f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\",\n                            \"lessThan\": \"3c591353956ffcace2cc74d09930774afed60619\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\",\n                            \"lessThan\": \"098927a13fd918bd7c64c2de905350a1ad7b4a3a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\",\n                            \"lessThan\": \"0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e50e5129f384ae282adebfb561189cdb19b81cee\",\n                            \"lessThan\": \"5701875f9609b000d91351eaa6bfd97fe2f157f4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ext4/inode.c\",\n                        \"fs/ext4/xattr.c\",\n                        \"fs/ext4/xattr.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.248\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.198\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.161\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.120\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.59\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14.2\",\n                            \"lessThanOrEqual\": \"6.14.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/27202452b0bc942fdc3db72a44c4dcdab96d5b56","https://git.kernel.org/stable/c/b374e9ecc92aaa7fb2ab221ee3ff5451118ab566","https://git.kernel.org/stable/c/c000a8a9b5343a5ef867df173c6349672dacbd0f","https://git.kernel.org/stable/c/3c591353956ffcace2cc74d09930774afed60619","https://git.kernel.org/stable/c/098927a13fd918bd7c64c2de905350a1ad7b4a3a","https://git.kernel.org/stable/c/0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8","https://git.kernel.org/stable/c/5701875f9609b000d91351eaa6bfd97fe2f157f4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-22121","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-22121","identifiers":["CVE-2025-22121"]},"retained":false,"historicalAffected":[]}],"coverage":[]}