Strix
26.1K

CVE-2025-40190

HIGHCVSS 7.8/10EPSS 0.21%

Last modified

CVE-2025-40190 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like: EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117 Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like: EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117 Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode(). This prevents the underflow and the follow-on orphan/cleanup churn.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
0.21%

10.7th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < ea39e712c2f5ae148ee5515798ae03523673e002; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1cfb3e4ddbdc8e02e637b8852540bd4718bf4814; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 505e69f76ac497e788f4ea0267826ec7266b40c8; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3d6269028246f4484bfed403c947a114bb583631; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 79ea7f3e11effe1bd9e753172981d9029133a278; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 6b879c4c6bbaab03c0ad2a983953bd1410bb165e; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 440b003f449a4ff2a00b08c8eab9ba5cd28f3943; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 57295e835408d8d425bef58da5253465db3d6888; < 5.4.301; < 5.10.246; < 5.15.195; < 6.1.157; < 6.6.113; < 6.12.54; < 6.17.4
LinuxLinuxAll versions

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2025-40190?
In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like: EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117 Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode(). This prevents the underflow and the follow-on orphan/cleanup churn.
How severe is CVE-2025-40190?
CVE-2025-40190 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2025-40190?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-40190?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST