CVE-2025-22113— ext4: avoid journaling sb update on error if journal is destroying
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ext4在日志销毁后仍尝试更新超级块，可能导致未定义行为。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1499 · Endpoint Denial of ServiceAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 2d01ddc86606564fb08c56e3bc93a0693895f710< b6d27f4869c9c4dedce0ba1c719d6c748a4ecc68 |
affected |
2d01ddc86606564fb08c56e3bc93a0693895f710< eddca44ddf810e27f0c96913aa3cc92ebd679ddb |
affected | ||
2d01ddc86606564fb08c56e3bc93a0693895f710< db05767b5bc307143d99fe2afd8c43af58d2ebef |
affected | ||
2d01ddc86606564fb08c56e3bc93a0693895f710< ce2f26e73783b4a7c46a86e3af5b5c8de0971790 |
affected | ||
5.11 |
affected | ||
< 5.11 |
unaffected | ||
6.6.160≤ 6.6.* |
unaffected | ||
6.12.46≤ 6.12.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-22113
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ext4: avoid journaling sb update on error if journal is destroying
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
ext4: avoid journaling sb update on error if journal is destroying
Presently we always BUG_ON if trying to start a transaction on a journal marked
with JBD2_UNMOUNT, since this should never happen. However, while ltp running
stress tests, it was observed that in case of some error handling paths, it is
possible for update_super_work to start a transaction after the journal is
destroyed eg:
(umount)
ext4_kill_sb
kill_block_super
generic_shutdown_super
sync_filesystem /* commits all txns */
evict_inodes
/* might start a new txn */
ext4_put_super
flush_work(&sbi->s_sb_upd_work) /* flush the workqueue */
jbd2_journal_destroy
journal_kill_thread
journal->j_flags |= JBD2_UNMOUNT;
jbd2_journal_commit_transaction
jbd2_journal_get_descriptor_buffer
jbd2_journal_bmap
ext4_journal_bmap
ext4_map_blocks
...
ext4_inode_error
ext4_handle_error
schedule_work(&sbi->s_sb_upd_work)
/* work queue kicks in */
update_super_work
jbd2_journal_start
start_this_handle
BUG_ON(journal->j_flags &
JBD2_UNMOUNT)
Hence, introduce a new mount flag to indicate journal is destroying and only do
a journaled (and deferred) update of sb if this flag is not set. Otherwise, just
fallback to an un-journaled commit.
Further, in the journal destroy path, we have the following sequence:
1. Set mount flag indicating journal is destroying
2. force a commit and wait for it
3. flush pending sb updates
This sequence is important as it ensures that, after this point, there is no sb
update that might be journaled so it is safe to update the sb outside the
journal. (To avoid race discussed in 2d01ddc86606)
Also, we don't need a similar check in ext4_grp_locked_error since it is only
called from mballoc and AFAICT it would be always valid to schedule work here.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ext4在日志销毁后仍尝试更新超级块，可能导致未定义行为。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-22113
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-22113
请登录查看更多情报信息。
Other References for CVE-2025-22113 (1)
Same Patch Batch · Linux · 2025-04-16 · 127 CVEs total
| CVE-2025-22021 | 10.0 CRITICAL | netfilter: socket: Lookup orig tuple for IPv6 SNAT |
| CVE-2025-22077 | 9.8 CRITICAL | Revert "smb: client: fix TCP timers deadlock after rmmod" |
| CVE-2025-22110 | 9.8 CRITICAL | netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error |
| CVE-2025-22088 | 9.8 CRITICAL | RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() |
| CVE-2025-22040 | 8.8 HIGH | ksmbd: fix session use-after-free in multichannel connection |
| CVE-2025-22118 | 8.8 HIGH | ice: validate queue quanta parameters to prevent OOB access |
| CVE-2025-22041 | 8.8 HIGH | ksmbd: fix use-after-free in ksmbd_sessions_deregister() |
| CVE-2025-22039 | 8.8 HIGH | ksmbd: fix overflow in dacloffset bounds check |
| CVE-2025-22074 | 8.8 HIGH | ksmbd: fix r_count dec/increment mismatch |
| CVE-2024-58096 | 8.8 HIGH | wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode |
| CVE-2025-22086 | 8.8 HIGH | RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow |
| CVE-2025-23133 | 8.8 HIGH | wifi: ath11k: update channel list in reg notifier instead reg worker |
| CVE-2025-22117 | 8.7 HIGH | ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() |
| CVE-2025-22108 | 8.6 HIGH | bnxt_en: Mask the bd_cnt field in the TX BD properly |
| CVE-2025-22080 | 8.4 HIGH | fs/ntfs3: Prevent integer overflow in hdr_first_de() |
| CVE-2025-22121 | 8.4 HIGH | ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() |
| CVE-2025-22038 | 8.3 HIGH | ksmbd: validate zero num_subauth before sub_auth is accessed |
| CVE-2025-22042 | 8.1 HIGH | ksmbd: add bounds check for create lease context |
| CVE-2025-22043 | 8.1 HIGH | ksmbd: add bounds check for durable handle context |
| CVE-2025-22049 | 7.8 HIGH | LoongArch: Increase ARCH_DMA_MINALIGN up to 16 |
Showing top 20 of 127 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Same vendor: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
V. Comments for CVE-2025-22113
No comments yet