Junglewise Threat Intelligence

CVE-2025-68820: Linux Kernel ext4 null pointer dereference in xattr handling

CVE-2025-68820 · Severity: info · CVSS 0 · Published 2026-01-13

Technologies: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's ext4 file system could allow a local attacker to cause a system crash. The issue occurs when the system attempts to process extended attributes on a corrupted file system, leading to a null pointer dereference. This primarily impacts system availability, potentially causing a denial-of-service condition on affected devices, including certain industrial controllers.

Technical details

A null pointer dereference exists in the ext4_raw_inode() function within fs/ext4/xattr.c. The root cause is a lack of error checking in ext4_xattr_inode_dec_ref_all() after a call to ext4_get_inode_loc(). If ext4_get_inode_loc() fails (returning an error such as -EFSCORRUPTED), the buffer head (iloc.bh) remains NULL. Subsequent execution immediately calls ext4_raw_inode(&iloc), which dereferences the NULL pointer. This vulnerability can be triggered by a local user interacting with a specially crafted or corrupted ext4 filesystem. Patches have been merged into multiple stable branches of the Linux kernel.

Affected products

  • Linux Linux Kernel fs/ext4/xattr.c
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2025-10-22: disclosed: Initial patch submission
  • 2026-01-13: advisory: NVD publication date
  • 2026-01-11: patched: Merged into stable kernel trees

References

Related threats