Executive brief
A vulnerability in the Linux kernel's OCFS2 file system could allow a local user to cause a system crash. The issue occurs when the system fails to update its internal records after moving or defragmenting data on the disk, leading to a mismatch that triggers a kernel panic. This can result in a total loss of system availability and potential data corruption.
Technical details
A race condition or logic error exists in the OCFS2 file system where the extent map cache becomes stale after operations like ioctl(FITRIM) or defragmentation. Specifically, __ocfs2_move_extents_range() reads and caches extent flags, but subsequent disk updates that clear the OCFS2_EXT_REFCOUNTED flag are not reflected in the cache. When later write operations encounter this mismatch, a BUG_ON is triggered in ocfs2_refcount_cal_cow_clusters(), resulting in a kernel panic. The fix involves explicitly invalidating the extent cache using ocfs2_extent_map_trunc() after each move or defrag operation.
Affected products
- Linux Linux Kernel 3.0 to 6.1.158, 5.4.301, 5.10.246, 5.15.196
Timeline
- 2025-10-09: other: Vulnerability reported by syzbot
- 2025-10-15: patched: Initial fix committed to mainline kernel
- 2025-12-04: advisory: CVE-2025-40233 published
References
- https://git.kernel.org/stable/c/78a63493f8e352296dbc7cb7b3f4973105e8679e
- https://git.kernel.org/stable/c/93166bc53c0e3587058327a4121daea34b4fecd5
- https://git.kernel.org/stable/c/93b1ab422f1966b71561158e1aedce4ec100f357
- https://git.kernel.org/stable/c/a21750df2f6169af6e039a3bb4893d6c9564e48d
- https://git.kernel.org/stable/c/a7ee72286efba1d407c6f15a0528e43593fb7007
- https://git.kernel.org/stable/c/aa6a21409dd6221bb268b56bb410e031c632ff9a
- https://git.kernel.org/stable/c/bb69928ed578f881e68d26aaf1a8f6e7faab3b44