Executive brief
A vulnerability in the Linux kernel's ext4 file system could allow a local attacker to cause a system crash. The issue occurs when the system attempts to process extended attributes on a corrupted file system, leading to a null pointer dereference. This primarily impacts system availability, potentially causing a denial-of-service condition on affected devices, including certain industrial controllers.
Technical details
A null pointer dereference exists in the ext4_raw_inode() function within fs/ext4/xattr.c. The root cause is a lack of error checking in ext4_xattr_inode_dec_ref_all() after a call to ext4_get_inode_loc(). If ext4_get_inode_loc() fails (returning an error such as -EFSCORRUPTED), the buffer head (iloc.bh) remains NULL. Subsequent execution immediately calls ext4_raw_inode(&iloc), which dereferences the NULL pointer. This vulnerability can be triggered by a local user interacting with a specially crafted or corrupted ext4 filesystem. Patches have been merged into multiple stable branches of the Linux kernel.
Affected products
- Linux Linux Kernel fs/ext4/xattr.c
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-10-22: disclosed: Initial patch submission
- 2026-01-13: advisory: NVD publication date
- 2026-01-11: patched: Merged into stable kernel trees
References
- https://git.kernel.org/stable/c/190ad0f22ba49f1101182b80e3af50ca2ddfe72f
- https://git.kernel.org/stable/c/3d8d22e75f7edfa0b30ff27330fd6a1285d594c3
- https://git.kernel.org/stable/c/5b154e901fda2e98570b8f426a481f5740097dc2
- https://git.kernel.org/stable/c/b5d942922182e82724b7152cb998f540132885ec
- https://git.kernel.org/stable/c/b72a3476f0c97d02f63a6e9fff127348d55436f6
- https://git.kernel.org/stable/c/b97cb7d6a051aa6ebd57906df0e26e9e36c26d14
- https://git.kernel.org/stable/c/ce5f54c065a4a7cbb92787f4f140917112350142