Read the docs
TI-2025-16070 Aliases CVE-2025-22121GHSA-xmgf-j324-j5xq

ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()

Priority LOW 38CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 23 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() There's issue as follows: BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790 Read of size 4 at addr ffff88807b003000 by task syz-executor.0/15172 CPU: 3 PID: 15172 Comm: syz-executor.0 Call Trace: __dump_stack lib/dump_stack.c:82 [inline] dump_stack+0xbe/0xfd lib/dump_stack.c:123 print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400 __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560 kasan_report+0x3a/0x50 mm/kasan/report.c:585 ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137 ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896 ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323 evict+0x39f/0x880 fs/inode.c:622 iput_final fs/inode.c:1746 [inline] iput fs/inode.c:1772 [inline] iput+0x525/0x6c0 fs/inode.c:1758 ext4_orphan_cleanup fs/ext4/super.c:3298 [inline] ext4_fill_super+0x8c57/0xba40 fs/ext4/super.c:5300 mount_bdev+0x355/0x410 fs/super.c:1446 legacy_get_tree+0xfe/0x220 fs/fs_context.c:611 vfs_get_tree+0x8d/0x2f0 fs/super.c:1576 do_new_mount fs/namespace.c:2983 [inline] path_mount+0x119a/0x1ad0 fs/namespace.c:3316 do_mount+0xfc/0x110 fs/namespace.c:3329 __do_sys_mount fs/namespace.c:3540 [inline] __se_sys_mount+0x219/0x2e0 fs/namespace.c:3514 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Memory state around the buggy address: ffff88807b002f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88807b002f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88807b003000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88807b003080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88807b003100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Above issue happens as ext4_xattr_delete_inode() isn't check xattr is valid if xattr is in inode. To solve above issue call xattr_check_inode() check if xattr if valid in inode. In fact, we can directly verify in ext4_iget_extra_inode(), so that there is no divergent verification.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Fix Partial Linux (Linux): 5.10.248, 5.15.198, 6.1.161 +4Red Hat: 7 advisoriesRed Hat: 23 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux4.13 and later5.10.248, 5.15.198, 6.1.161, 6.6.120, 6.12.59, 6.14.2, 6.15Patch availableCNA
  • Linux VendorLinux Affected 4.13 and later Fixed in 5.10.248, 5.15.198, 6.1.161, 6.6.120, 6.12.59, 6.14.2, 6.15 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*4.13 to before 6.14.2VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.13 to before 6.14.2 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.10.248, 5.15.198, 6.1.161, 6.6.120, 6.12.59, 6.14.2, 6.15

Red Hat 7 advisories

  • RHSA-2025:11861 Released 2025-07-28 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-570.30.1.el9_6, kernel-64k-debug-devel-matched-5.14.0-570.30.1.el9_6, kernel-64k-devel-5.14.0-570.30.1.el9_6 +12
    • Red Hat Enterprise Linux BaseOS (v. 9) kernel-5.14.0-570.30.1.el9_6, kernel-64k-5.14.0-570.30.1.el9_6, kernel-64k-core-5.14.0-570.30.1.el9_6 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-570.30.1.el9_6, libperf-5.14.0-570.30.1.el9_6
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-570.30.1.el9_6, kernel-rt-64k-5.14.0-570.30.1.el9_6, kernel-rt-64k-core-5.14.0-570.30.1.el9_6 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-570.30.1.el9_6, kernel-rt-core-5.14.0-570.30.1.el9_6, kernel-rt-debug-5.14.0-570.30.1.el9_6 +11
  • RHSA-2025:11855 Released 2025-07-28 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream (v. 10) kernel-64k-debug-devel-6.12.0-55.24.1.el10_0, kernel-64k-debug-devel-matched-6.12.0-55.24.1.el10_0, kernel-64k-devel-6.12.0-55.24.1.el10_0 +12
    • Red Hat Enterprise Linux BaseOS (v. 10) kernel-6.12.0-55.24.1.el10_0, kernel-64k-6.12.0-55.24.1.el10_0, kernel-64k-core-6.12.0-55.24.1.el10_0 +28
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) kernel-tools-libs-devel-6.12.0-55.24.1.el10_0, libperf-6.12.0-55.24.1.el10_0
    • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt-6.12.0-55.24.1.el10_0, kernel-rt-64k-6.12.0-55.24.1.el10_0, kernel-rt-64k-core-6.12.0-55.24.1.el10_0 +21
    • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt-6.12.0-55.24.1.el10_0, kernel-rt-core-6.12.0-55.24.1.el10_0, kernel-rt-debug-6.12.0-55.24.1.el10_0 +11
  • RHSA-2025:11571 Released 2025-07-23 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) kernel-64k-debug-devel-5.14.0-284.126.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.126.1.el9_2, kernel-64k-devel-5.14.0-284.126.1.el9_2 +10
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool-7.0.0-284.126.1.el9_2, kernel-5.14.0-284.126.1.el9_2, kernel-64k-5.14.0-284.126.1.el9_2 +29
Show 4 more Red Hat advisories
  • RHSA-2025:11572 Released 2025-07-23 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt-5.14.0-284.126.1.rt14.411.el9_2, kernel-rt-core-5.14.0-284.126.1.rt14.411.el9_2, kernel-rt-debug-5.14.0-284.126.1.rt14.411.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt-5.14.0-284.126.1.rt14.411.el9_2, kernel-rt-core-5.14.0-284.126.1.rt14.411.el9_2, kernel-rt-debug-5.14.0-284.126.1.rt14.411.el9_2 +11
  • RHSA-2025:11245 Released 2025-07-15 · Red Hat rating Important
    kernel security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) kernel-tools-libs-devel-5.14.0-427.77.1.el9_4, libperf-5.14.0-427.77.1.el9_4
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) kernel-64k-debug-devel-5.14.0-427.77.1.el9_4, kernel-64k-debug-devel-matched-5.14.0-427.77.1.el9_4, kernel-64k-devel-5.14.0-427.77.1.el9_4 +11
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool-7.3.0-427.77.1.el9_4, kernel-5.14.0-427.77.1.el9_4, kernel-64k-5.14.0-427.77.1.el9_4 +29
    • Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt-5.14.0-427.77.1.el9_4, kernel-rt-core-5.14.0-427.77.1.el9_4, kernel-rt-debug-5.14.0-427.77.1.el9_4 +9
    • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt-5.14.0-427.77.1.el9_4, kernel-rt-core-5.14.0-427.77.1.el9_4, kernel-rt-debug-5.14.0-427.77.1.el9_4 +11
  • RHSA-2025:10830 Released 2025-07-14 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) kernel-debug-devel-5.14.0-70.138.1.el9_0, kernel-debug-devel-matched-5.14.0-70.138.1.el9_0, kernel-devel-5.14.0-70.138.1.el9_0 +5
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) bpftool-5.14.0-70.138.1.el9_0, kernel-5.14.0-70.138.1.el9_0, kernel-abi-stablelists-5.14.0-70.138.1.el9_0 +14
  • RHSA-2025:10829 Released 2025-07-14 · Red Hat rating Important
    kernel-rt security update
    • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt-5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-core-5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-debug-5.14.0-70.138.1.rt21.210.el9_0 +9
    • Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt-5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-core-5.14.0-70.138.1.rt21.210.el9_0, kernel-rt-debug-5.14.0-70.138.1.rt21.210.el9_0 +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:11245
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:11855
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:11861
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:10830
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:11571
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:11245
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:11855
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:11861
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:10830
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:11571
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:11245
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:11855
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:11861
Red Hat Enterprise Linux NFV E4S (v.9.0)Fixed RHSA-2025:10829
Red Hat Enterprise Linux Real Time (v. 10)Fixed RHSA-2025:11855
Red Hat Enterprise Linux Real Time (v. 9)Fixed RHSA-2025:11861
Red Hat Enterprise Linux Real Time E4S (v.9.0)Fixed RHSA-2025:10829
Red Hat Enterprise Linux Real Time E4S (v.9.2)Fixed RHSA-2025:11572
Red Hat Enterprise Linux Real Time EUS (v.9.4)Fixed RHSA-2025:11245
Red Hat Enterprise Linux Real Time for NFV (v. 10)Fixed RHSA-2025:11855
Red Hat Enterprise Linux Real Time for NFV (v. 9)Fixed RHSA-2025:11861
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)Fixed RHSA-2025:11572
Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)Fixed RHSA-2025:11245

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22121
  2. 2026-10-03 Alias added: GHSA-xmgf-j324-j5xq
  3. 2026-10-16 CISA SSVC decision points changed

References

Patch 2

Other 5

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences