CVE-2025-40167
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a journal. The issue is that the filesystem has an inode with both the INLINE_DATA and EXTENTS flags set: EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15: comm syz.0.17: corrupted extent tree: lblk 0 < prev 66 Investigation revealed that the inode has both flags set: DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1 This is an invalid combination since an inode should have either: - INLINE_DATA: data stored directly in the inode - EXTENTS: data stored in extent-mapped blocks Having both flags causes ext4_has_inline_data() to return true, skipping extent tree validation in __ext4_iget(). The unvalidated out-of-order extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer underflow when calculating hole sizes. Fix this by detecting this invalid flag combination early in ext4_iget() and rejecting the corrupted inode.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Deferred
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-11-12 11:15:47.013000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-40167",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-11-12T11:15:47.013",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: detect invalid INLINE_DATA + EXTENTS flag combination\n\nsyzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity\nfile on a corrupted ext4 filesystem mounted without a journal.\n\nThe issue is that the filesystem has an inode with both the INLINE_DATA\nand EXTENTS flags set:\n\n EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:\n comm syz.0.17: corrupted extent tree: lblk 0 < prev 66\n\nInvestigation revealed that the inode has both flags set:\n DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1\n\nThis is an invalid combination since an inode should have either:\n- INLINE_DATA: data stored directly in the inode\n- EXTENTS: data stored in extent-mapped blocks\n\nHaving both flags causes ext4_has_inline_data() to return true, skipping\nextent tree validation in __ext4_iget(). The unvalidated out-of-order\nextents then trigger a BUG_ON in ext4_es_cache_extent() due to integer\nunderflow when calculating hole sizes.\n\nFix this by detecting this invalid flag combination early in ext4_iget()\nand rejecting the corrupted inode."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: detectar combinación inválida de las banderas INLINE_DATA + EXTENTS\n\nsyzbot informó un BUG_ON en ext4_es_cache_extent() al abrir un archivo verity en un sistema de archivos ext4 corrupto montado sin un journal.\n\nEl problema es que el sistema de archivos tiene un inodo con las banderas INLINE_DATA y EXTENTS ambas establecidas:\n\n Error de EXT4-fs (dispositivo loop0): ext4_cache_extents:545: inodo #15:\n comm syz.0.17: árbol de extents corrupto: lblk 0 < prev 66\n\nLa investigación reveló que el inodo tiene ambas banderas establecidas:\n DEBUG: inodo 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1\n\nEsta es una combinación inválida ya que un inodo debería tener una de las siguientes:\n- INLINE_DATA: datos almacenados directamente en el inodo\n- EXTENTS: datos almacenados en bloques mapeados por extents\n\nTener ambas banderas hace que ext4_has_inline_data() devuelva verdadero, saltándose la validación del árbol de extents en __ext4_iget(). Los extents no validados y fuera de orden entonces disparan un BUG_ON en ext4_es_cache_extent() debido a un desbordamiento negativo de enteros al calcular los tamaños de los huecos.\n\nEsto se soluciona detectando esta combinación de banderas inválida temprano en ext4_iget() y rechazando el inodo corrupto."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e",
"lessThan": "4954d297c91d292630ab43ba4d195dc371ce65d3",
"versionType": "git",
"status": "affected"
},
{
"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e",
"lessThan": "f061f7c331fc16250fc82aa68964f35821687217",
"versionType": "git",
"status": "affected"
},
{
"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e",
"lessThan": "2e9e10657b04152ed0d6ecae8d0c02a3405e28f5",
"versionType": "git",
"status": "affected"
},
{
"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e",
"lessThan": "1437c95ab2a28b138d4521653583729f61ccb48b",
"versionType": "git",
"status": "affected"
},
{
"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e",
"lessThan": "cb6039b68efa547b676a8a10fc4618d9d1865c23",
"versionType": "git",
"status": "affected"
},
{
"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e",
"lessThan": "de985264eef64be8a90595908f2e6a87946dad34",
"versionType": "git",
"status": "affected"
},
{
"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e",
"lessThan": "1f5ccd22ff482639133f2a0fe08f6d19d0e68717",
"versionType": "git",
"status": "affected"
},
{
"version": "f19d5870cbf72d4cb2a8e1f749dff97af99b071e",
"lessThan": "1d3ad183943b38eec2acf72a0ae98e635dc8456b",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.8",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.8",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.4.301",
"lessThanOrEqual": "5.4.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.246",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.196",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.158",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.114",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.55",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.5",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-15T21:57:26.297320Z",
"id": "CVE-2025-40167",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1437c95ab2a28b138d4521653583729f61ccb48b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1d3ad183943b38eec2acf72a0ae98e635dc8456b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1f5ccd22ff482639133f2a0fe08f6d19d0e68717",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2e9e10657b04152ed0d6ecae8d0c02a3405e28f5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4954d297c91d292630ab43ba4d195dc371ce65d3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cb6039b68efa547b676a8a10fc4618d9d1865c23",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de985264eef64be8a90595908f2e6a87946dad34",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f061f7c331fc16250fc82aa68964f35821687217",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}