Junglewise Threat Intelligence

CVE-2025-40233: Linux Kernel OCFS2 denial of service via stale extent cache

CVE-2025-40233 · Severity: high · CVSS 7.8 · Published 2025-12-04

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's OCFS2 file system could allow a local user to cause a system crash. The issue occurs when the system fails to update its internal records after moving or defragmenting data on the disk, leading to a mismatch that triggers a kernel panic. This can result in a total loss of system availability and potential data corruption.

Technical details

A race condition or logic error exists in the OCFS2 file system where the extent map cache becomes stale after operations like ioctl(FITRIM) or defragmentation. Specifically, __ocfs2_move_extents_range() reads and caches extent flags, but subsequent disk updates that clear the OCFS2_EXT_REFCOUNTED flag are not reflected in the cache. When later write operations encounter this mismatch, a BUG_ON is triggered in ocfs2_refcount_cal_cow_clusters(), resulting in a kernel panic. The fix involves explicitly invalidating the extent cache using ocfs2_extent_map_trunc() after each move or defrag operation.

Affected products

  • Linux Linux Kernel 3.0 to 6.1.158, 5.4.301, 5.10.246, 5.15.196

Timeline

  • 2025-10-09: other: Vulnerability reported by syzbot
  • 2025-10-15: patched: Initial fix committed to mainline kernel
  • 2025-12-04: advisory: CVE-2025-40233 published

References

Related threats