Ext4 Filesystem Vulnerability in Linux Kernel by Open Source Vendor

CVE-2025-40190

What is CVE-2025-40190?

A vulnerability in the ext4 filesystem has been identified where the function ext4_xattr_inode_update_ref() can read an EA inode refcount that is already non-positive. This leads to a scenario where the reference count may underflow, resulting in critical filesystem errors. If the current refcount is found to be non-positive, the system will treat this as on-disk corruption and will appropriately fail the operation to prevent further erroneous behavior. This change improves the filesystem's integrity and stability by eliminating the potential for bogus refcount values and related cleanup issues.

References