Executive brief
A race condition vulnerability was identified in the Linux kernel's ext4 file system. This issue occurs when the system simultaneously attempts to destroy inline data and map file blocks, potentially leading to a system crash (kernel BUG). For businesses, this represents a risk to system availability and could lead to unplanned downtime or service disruptions on affected Linux-based servers or embedded industrial controllers.
Technical details
A race condition exists in the ext4 filesystem within the 'ext4_destroy_inline_data_nolock()' function. The root cause is a lack of 'i_data_sem' protection when the function modifies the inode data layout by clearing the 'EXT4_INODE_INLINE_DATA' flag and setting 'EXT4_INODE_EXTENTS'. Simultaneously, another thread executing 'ext4_map_blocks()' may check these flags and incorrectly call 'ext4_ind_map_blocks()' for an inode that has the extents flag set, triggering a kernel assertion (BUG at fs/ext4/indirect.c:546). This is a local attack vector requiring the ability to perform file I/O operations. The vulnerability has been patched in multiple stable branches of the Linux kernel.
Affected products
- Linux Linux Kernel v4.11+
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-11-04: disclosed: Initial patch submitted by Alexey Nepomnyashih
- 2025-12-16: advisory: CVE-2025-68261 published
References
- https://git.kernel.org/stable/c/0cd8feea8777f8d9b9a862b89c688b049a5c8475
- https://git.kernel.org/stable/c/144c48da33a01d92995aeccd8208eb47d2a8e659
- https://git.kernel.org/stable/c/22a76b0861ae61a299c8e126c1aca8c4fda820fd
- https://git.kernel.org/stable/c/5b266cf6851ce72b11b067fe02adf5a8687104ad
- https://git.kernel.org/stable/c/5cad18e527ba8a9ca5463cc170073eeb5a4826f4
- https://git.kernel.org/stable/c/61e03dc3794ebf77a706b85e5a36c9c6d70be6de
- https://git.kernel.org/stable/c/b322bac9f01d03190b5abc52be5d9dd9f22a2b41