Junglewise Threat Intelligence

CVE-2025-40190: Linux Kernel ext4 refcount underflow in xattr update

CVE-2025-40190 · Severity: high · CVSS 7.8 · Published 2025-11-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's ext4 file system, which is responsible for managing how data is stored on many Linux-based computers and servers. An error in how the system tracks file attributes could allow a malicious actor to cause system instability or potentially gain unauthorized access to data. This issue primarily affects systems where an attacker can trick a user or process into interacting with a specially crafted file or disk image.

Technical details

A reference count underflow vulnerability exists in the ext4 file system within the 'ext4_xattr_inode_update_ref' function in 'fs/ext4/xattr.c'. The root cause is a failure to validate the EA inode reference count before decrementing it; if the count is already zero or negative, the operation proceeds, leading to an underflow and subsequent use of a bogus value. An attacker could exploit this by providing a corrupted filesystem image or manipulating extended attributes to trigger the underflow, potentially leading to a use-after-free or other memory corruption scenarios. The fix introduces explicit checks to treat non-positive refcounts as on-disk corruption (-EFSCORRUPTED) and prevents the underflow. Patches have been backported to various stable kernel branches including 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.12.y.

Affected products

  • Linux Linux Kernel versions before 5.4.301, 5.10.246, 5.15.195, 6.1.157, 6.6.113, 6.12.54, 6.17.4

Timeline

  • 2025-11-12: disclosed
  • 2025-11-12: advisory

References

Related threats