Riskcovery

CVE-2025-38701

ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr

State
Published
Severity
Not scored
Published
Sep 4, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr

A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute.

Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system.

Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 67cf5b09a46f72e048501b84996f2f77bc42e947 to before 8085a7324d8ec448c4a764af7853e19bbd64e17aAffected
  • 67cf5b09a46f72e048501b84996f2f77bc42e947 to before 1199a6399895f4767f0b9a68a6ff47c3f799b7c7Affected
  • 67cf5b09a46f72e048501b84996f2f77bc42e947 to before 7f322c12df7aeed1755acd3c6fab48c7807795fbAffected
  • 67cf5b09a46f72e048501b84996f2f77bc42e947 to before 2817ac83cb4732597bf36853fe13ca616f4ee4e2Affected
  • 67cf5b09a46f72e048501b84996f2f77bc42e947 to before d960f4b793912f35e9d72bd9d1e90553063fcbf1Affected
  • 67cf5b09a46f72e048501b84996f2f77bc42e947 to before 81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919cAffected
  • 67cf5b09a46f72e048501b84996f2f77bc42e947 to before 279c87ef7b9da34f65c2e4db586e730b667a6fb9Affected
  • 67cf5b09a46f72e048501b84996f2f77bc42e947 to before 8a6f89d42e61788605722dd9faf98797c958a7e5Affected
  • 67cf5b09a46f72e048501b84996f2f77bc42e947 to before 099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42Affected
LinuxLinux
  • 3.8Affected
  • before 3.8Not affected
  • 5.4.297 through 5.4.*Not affected
  • 5.10.241 through 5.10.*Not affected
  • 5.15.190 through 5.15.*Not affected
  • 6.1.149 through 6.1.*Not affected
  • 6.6.103 through 6.6.*Not affected
  • 6.12.43 through 6.12.*Not affected
  • 6.15.11 through 6.15.*Not affected
  • 6.16.2 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.