Message-ID: <2025111228-CVE-2025-40167-184f@gregkh>
Date: Wed, 12 Nov 2025 19:26:33 +0900
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ext4: detect invalid INLINE_DATA + EXTENTS flag combination

syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity
file on a corrupted ext4 filesystem mounted without a journal.

The issue is that the filesystem has an inode with both the INLINE_DATA
and EXTENTS flags set:

    EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15:
    comm syz.0.17: corrupted extent tree: lblk 0 < prev 66

Investigation revealed that the inode has both flags set:
    DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1

This is an invalid combination since an inode should have either:
- INLINE_DATA: data stored directly in the inode
- EXTENTS: data stored in extent-mapped blocks

Having both flags causes ext4_has_inline_data() to return true, skipping
extent tree validation in __ext4_iget(). The unvalidated out-of-order
extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer
underflow when calculating hole sizes.

Fix this by detecting this invalid flag combination early in ext4_iget()
and rejecting the corrupted inode.

The Linux kernel CVE team has assigned CVE-2025-40167 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.4.301 with commit 4954d297c91d292630ab43ba4d195dc371ce65d3
	Fixed in 5.10.246 with commit f061f7c331fc16250fc82aa68964f35821687217
	Fixed in 5.15.196 with commit 2e9e10657b04152ed0d6ecae8d0c02a3405e28f5
	Fixed in 6.1.158 with commit 1437c95ab2a28b138d4521653583729f61ccb48b
	Fixed in 6.6.114 with commit cb6039b68efa547b676a8a10fc4618d9d1865c23
	Fixed in 6.12.55 with commit de985264eef64be8a90595908f2e6a87946dad34
	Fixed in 6.17.5 with commit 1f5ccd22ff482639133f2a0fe08f6d19d0e68717
	Fixed in 6.18-rc2 with commit 1d3ad183943b38eec2acf72a0ae98e635dc8456b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40167
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ext4/inode.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4954d297c91d292630ab43ba4d195dc371ce65d3
	https://git.kernel.org/stable/c/f061f7c331fc16250fc82aa68964f35821687217
	https://git.kernel.org/stable/c/2e9e10657b04152ed0d6ecae8d0c02a3405e28f5
	https://git.kernel.org/stable/c/1437c95ab2a28b138d4521653583729f61ccb48b
	https://git.kernel.org/stable/c/cb6039b68efa547b676a8a10fc4618d9d1865c23
	https://git.kernel.org/stable/c/de985264eef64be8a90595908f2e6a87946dad34
	https://git.kernel.org/stable/c/1f5ccd22ff482639133f2a0fe08f6d19d0e68717
	https://git.kernel.org/stable/c/1d3ad183943b38eec2acf72a0ae98e635dc8456b

Powered by blists - more mailing lists