Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-22121— ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ext4_xattr_inode_dec_ref_all函数存在越界读取问题。

CVSS 8.4 · High EPSS 0.22% · P12

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux e50e5129f384ae282adebfb561189cdb19b81cee< 27202452b0bc942fdc3db72a44c4dcdab96d5b56 affected
e50e5129f384ae282adebfb561189cdb19b81cee< b374e9ecc92aaa7fb2ab221ee3ff5451118ab566 affected
e50e5129f384ae282adebfb561189cdb19b81cee< c000a8a9b5343a5ef867df173c6349672dacbd0f affected
e50e5129f384ae282adebfb561189cdb19b81cee< 3c591353956ffcace2cc74d09930774afed60619 affected
e50e5129f384ae282adebfb561189cdb19b81cee< 098927a13fd918bd7c64c2de905350a1ad7b4a3a affected
e50e5129f384ae282adebfb561189cdb19b81cee< 0c8fbb6ffb3c8f5164572ca88e4ccb6cd6a41ca8 affected
e50e5129f384ae282adebfb561189cdb19b81cee< 5701875f9609b000d91351eaa6bfd97fe2f157f4 affected
4.13 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-22121

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() There's issue as follows: BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790 Read of size 4 at addr ffff88807b003000 by task syz-executor.0/15172 CPU: 3 PID: 15172 Comm: syz-executor.0 Call Trace: __dump_stack lib/dump_stack.c:82 [inline] dump_stack+0xbe/0xfd lib/dump_stack.c:123 print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400 __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560 kasan_report+0x3a/0x50 mm/kasan/report.c:585 ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137 ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896 ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323 evict+0x39f/0x880 fs/inode.c:622 iput_final fs/inode.c:1746 [inline] iput fs/inode.c:1772 [inline] iput+0x525/0x6c0 fs/inode.c:1758 ext4_orphan_cleanup fs/ext4/super.c:3298 [inline] ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300 mount_bdev+0x355/0x410 fs/super.c:1446 legacy_get_tree+0xfe/0x220 fs/fs_context.c:611 vfs_get_tree+0x8d/0x2f0 fs/super.c:1576 do_new_mount fs/namespace.c:2983 [inline] path_mount+0x119a/0x1ad0 fs/namespace.c:3316 do_mount+0xfc/0x110 fs/namespace.c:3329 __do_sys_mount fs/namespace.c:3540 [inline] __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Memory state around the buggy address: ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Above issue happens as ext4_xattr_delete_inode() isn't check xattr is valid if xattr is in inode. To solve above issue call xattr_check_inode() check if xattr if valid in inode. In fact, we can directly verify in ext4_iget_extra_inode(), so that there is no divergent verification.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ext4_xattr_inode_dec_ref_all函数存在越界读取问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e50e5129f384ae282adebfb561189cdb19b81cee ~ 27202452b0bc942fdc3db72a44c4dcdab96d5b56 -
Linux Linux 4.13 -

II. Public POCs for CVE-2025-22121

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-22121

请登录查看更多情报信息。

Other References for CVE-2025-22121 (2)

Same Patch Batch · Linux · 2025-04-16 · 127 CVEs total

CVE-2025-22021 10.0 CRITICAL netfilter: socket: Lookup orig tuple for IPv6 SNAT
CVE-2025-22077 9.8 CRITICAL Revert "smb: client: fix TCP timers deadlock after rmmod"
CVE-2025-22110 9.8 CRITICAL netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error
CVE-2025-22088 9.8 CRITICAL RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
CVE-2025-22040 8.8 HIGH ksmbd: fix session use-after-free in multichannel connection
CVE-2025-22074 8.8 HIGH ksmbd: fix r_count dec/increment mismatch
CVE-2025-23133 8.8 HIGH wifi: ath11k: update channel list in reg notifier instead reg worker
CVE-2025-22086 8.8 HIGH RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
CVE-2024-58096 8.8 HIGH wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
CVE-2025-22039 8.8 HIGH ksmbd: fix overflow in dacloffset bounds check
CVE-2025-22041 8.8 HIGH ksmbd: fix use-after-free in ksmbd_sessions_deregister()
CVE-2025-22118 8.8 HIGH ice: validate queue quanta parameters to prevent OOB access
CVE-2025-22117 8.7 HIGH ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
CVE-2025-22108 8.6 HIGH bnxt_en: Mask the bd_cnt field in the TX BD properly
CVE-2025-22080 8.4 HIGH fs/ntfs3: Prevent integer overflow in hdr_first_de()
CVE-2025-22038 8.3 HIGH ksmbd: validate zero num_subauth before sub_auth is accessed
CVE-2025-22043 8.1 HIGH ksmbd: add bounds check for durable handle context
CVE-2025-22042 8.1 HIGH ksmbd: add bounds check for create lease context
CVE-2025-22047 7.8 HIGH x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
CVE-2025-22109 7.8 HIGH ax25: Remove broken autobind

Showing top 20 of 127 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-22121

No comments yet

Leave a comment