Executive brief
A vulnerability in the Linux kernel's ext4 file system could allow a local user to crash the system. The issue occurs when handling specific file write operations on systems with the 'inline_data' feature enabled. An exploit results in a kernel panic, leading to a complete system outage and denial of service.
Technical details
An integer overflow vulnerability exists in the ext4 filesystem component of the Linux kernel, specifically within the ext4_prepare_inline_data function. The root cause is the use of an 'unsigned int' for the length parameter, which can be truncated when processing large file offsets (e.g., using pwrite with an offset exceeding 32 bits). This truncation causes a subsequent sanity check (BUG_ON) in ext4_write_inline_data to fail during the write_end phase, triggering a kernel panic. The vulnerability requires the 'inline_data' feature to be enabled on the ext4 partition. A local attacker with standard file write permissions can trigger this crash. The fix involves changing the length parameter type to 'loff_t' to correctly handle 64-bit offsets.
Affected products
- Linux Linux Kernel versions prior to 6.15-rc2
Timeline
- 2025-04-15: patched: Initial patch submitted by Thadeu Lima de Souza Cascardo
- 2025-07-04: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/227cb4ca5a6502164f850d22aec3104d7888b270
- https://git.kernel.org/stable/c/26e09d18599da0adc543eabd300080daaeda6869
- https://git.kernel.org/stable/c/5766da2237e539f259aa0e5f3639ae37b44ca458
- https://git.kernel.org/stable/c/717414a8c083c376d4a8940a1230fe0c6ed4ee00
- https://git.kernel.org/stable/c/9d1d1c5bf4fc1af76be154d3afb2acdbd89ec7d8
- https://git.kernel.org/stable/c/cf5f319a2d8ab8238f8cf3a19463b9bff6420934
- https://git.kernel.org/stable/c/d3dfc60efd145df5324b99a244b0b05505cde29b