Executive brief
The Linux ext4 filesystem's extent lookup function contains a use-after-free vulnerability when both the "bigalloc" and "inline data" features are enabled. An attacker who can write data to a specially configured ext4 volume can read previously freed memory, potentially exposing sensitive kernel data or causing a system crash.
Technical details
The vulnerability is a use-after-free read in ext4_find_extent() (extents.c:931), exposed via ext4_ext_binsearch_idx() during extent lookups. The root cause occurs when inline data is converted to extent format by ext4_da_convert_inline_data_to_extent() before writepages, leaving the EXT4_STATE_MAY_INLINE_DATA flag unset while i_data still contains inline data. The ext4_clu_mapped() function fails to check for inline data in this state, causing it to treat freed memory as valid extent tree data. An attacker with write access to the filesystem can trigger this via buffered writes to files on volumes with both bigalloc and inline data enabled. The fix adds an ext4_has_inline_data() check in ext4_clu_mapped().
Affected products
- Linux Linux Kernel 6.2.0-rc1 and likely earlier versions with ext4 support
Timeline
- 2025-10-22: disclosed