In the Linux kernel, the following vulnerability has been resolved:
ext4: do not BUG when INLINEDATAFL lacks system.data xattr
A syzbot fuzzed image triggered a BUGON in ext4updateinlinedata() when an inode had the INLINEDATAFL flag set but was missing the system.data extended attribute.
Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system.
Add similar replacements of BUGON with EXT4ERRORINODE() ii ext4createinlinedata() and ext4inlinedata_truncate().
[
{
"signature_version": "v1",
"id": "CVE-2025-38701-07047b51",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d960f4b793912f35e9d72bd9d1e90553063fcbf1",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_update_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "131295844368662557030983119847708473734",
"length": 1409.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-225f9f77",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1199a6399895f4767f0b9a68a6ff47c3f799b7c7",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_create_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "327112745068058261292670714736115227526",
"length": 1395.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-2c779256",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@279c87ef7b9da34f65c2e4db586e730b667a6fb9",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_update_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "131295844368662557030983119847708473734",
"length": 1409.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-2f6d79cf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_update_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "131295844368662557030983119847708473734",
"length": 1409.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-366b3ad5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2817ac83cb4732597bf36853fe13ca616f4ee4e2",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_inline_data_truncate"
},
"signature_type": "Function",
"digest": {
"function_hash": "171415503465144171630929082839398420490",
"length": 2284.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-409f9a9d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8085a7324d8ec448c4a764af7853e19bbd64e17a",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_update_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "238708223110900591083258609549854128452",
"length": 1377.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-5cf1af53",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d960f4b793912f35e9d72bd9d1e90553063fcbf1",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327579885649970295337345006505799132936",
"191654583863534662730560198925369224913",
"107308160957581167997351344544597896275",
"222957225900811065500111868380632775470",
"59236753561431190362888896461179744347",
"19746757559404146057655195966301991705",
"75385777469911729313672938220630922899",
"68547588308660828112642272895238793052",
"101815201751909415294122991798426341546",
"333601029962456490955627052893249127054",
"282248606686448189966090272585866638778",
"36159692925955900071296863865144051746"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-5fed4190",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1199a6399895f4767f0b9a68a6ff47c3f799b7c7",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_inline_data_truncate"
},
"signature_type": "Function",
"digest": {
"function_hash": "65098667450084208631981665582654723350",
"length": 2073.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-631cb2fa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@279c87ef7b9da34f65c2e4db586e730b667a6fb9",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327579885649970295337345006505799132936",
"191654583863534662730560198925369224913",
"107308160957581167997351344544597896275",
"222957225900811065500111868380632775470",
"59236753561431190362888896461179744347",
"19746757559404146057655195966301991705",
"75385777469911729313672938220630922899",
"68547588308660828112642272895238793052",
"101815201751909415294122991798426341546",
"333601029962456490955627052893249127054",
"282248606686448189966090272585866638778",
"36159692925955900071296863865144051746"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-688d5531",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1199a6399895f4767f0b9a68a6ff47c3f799b7c7",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327579885649970295337345006505799132936",
"191654583863534662730560198925369224913",
"107308160957581167997351344544597896275",
"222957225900811065500111868380632775470",
"59236753561431190362888896461179744347",
"19746757559404146057655195966301991705",
"75385777469911729313672938220630922899",
"68547588308660828112642272895238793052",
"101815201751909415294122991798426341546",
"333601029962456490955627052893249127054",
"282248606686448189966090272585866638778",
"36159692925955900071296863865144051746"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-69fad47e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d960f4b793912f35e9d72bd9d1e90553063fcbf1",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_create_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "146434802082921205205130901881097404766",
"length": 1427.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-77bcccc9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d960f4b793912f35e9d72bd9d1e90553063fcbf1",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_inline_data_truncate"
},
"signature_type": "Function",
"digest": {
"function_hash": "127513462518618869870384488155934678943",
"length": 2155.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-8ccff3d0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@279c87ef7b9da34f65c2e4db586e730b667a6fb9",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_create_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "146434802082921205205130901881097404766",
"length": 1427.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-8f04a2c5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8085a7324d8ec448c4a764af7853e19bbd64e17a",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_create_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "327112745068058261292670714736115227526",
"length": 1395.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-9cf15fd5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@279c87ef7b9da34f65c2e4db586e730b667a6fb9",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_inline_data_truncate"
},
"signature_type": "Function",
"digest": {
"function_hash": "127513462518618869870384488155934678943",
"length": 2155.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-a9c552a7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8085a7324d8ec448c4a764af7853e19bbd64e17a",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327579885649970295337345006505799132936",
"191654583863534662730560198925369224913",
"107308160957581167997351344544597896275",
"222957225900811065500111868380632775470",
"59236753561431190362888896461179744347",
"19746757559404146057655195966301991705",
"75385777469911729313672938220630922899",
"68547588308660828112642272895238793052",
"101815201751909415294122991798426341546",
"333601029962456490955627052893249127054",
"282248606686448189966090272585866638778",
"36159692925955900071296863865144051746"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-ac509dd1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8085a7324d8ec448c4a764af7853e19bbd64e17a",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_inline_data_truncate"
},
"signature_type": "Function",
"digest": {
"function_hash": "65098667450084208631981665582654723350",
"length": 2073.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-b9226fcb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_create_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "146434802082921205205130901881097404766",
"length": 1427.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-c23f31a1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_update_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "131295844368662557030983119847708473734",
"length": 1409.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-c4b33ff7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_inline_data_truncate"
},
"signature_type": "Function",
"digest": {
"function_hash": "292841167314257891918416938108471259425",
"length": 2159.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-cd3f3e0e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2817ac83cb4732597bf36853fe13ca616f4ee4e2",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_update_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "131295844368662557030983119847708473734",
"length": 1409.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-dbdbc0d3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_create_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "146434802082921205205130901881097404766",
"length": 1427.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-ddb8978a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1199a6399895f4767f0b9a68a6ff47c3f799b7c7",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_update_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "238708223110900591083258609549854128452",
"length": 1377.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-df9d2a92",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327579885649970295337345006505799132936",
"191654583863534662730560198925369224913",
"107308160957581167997351344544597896275",
"222957225900811065500111868380632775470",
"59236753561431190362888896461179744347",
"19746757559404146057655195966301991705",
"75385777469911729313672938220630922899",
"68547588308660828112642272895238793052",
"101815201751909415294122991798426341546",
"333601029962456490955627052893249127054",
"282248606686448189966090272585866638778",
"36159692925955900071296863865144051746"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-ebdf6575",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2817ac83cb4732597bf36853fe13ca616f4ee4e2",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327579885649970295337345006505799132936",
"191654583863534662730560198925369224913",
"107308160957581167997351344544597896275",
"222957225900811065500111868380632775470",
"59236753561431190362888896461179744347",
"19746757559404146057655195966301991705",
"75385777469911729313672938220630922899",
"68547588308660828112642272895238793052",
"101815201751909415294122991798426341546",
"333601029962456490955627052893249127054",
"282248606686448189966090272585866638778",
"36159692925955900071296863865144051746"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-efd2b1eb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327579885649970295337345006505799132936",
"191654583863534662730560198925369224913",
"107308160957581167997351344544597896275",
"222957225900811065500111868380632775470",
"59236753561431190362888896461179744347",
"19746757559404146057655195966301991705",
"75385777469911729313672938220630922899",
"68547588308660828112642272895238793052",
"101815201751909415294122991798426341546",
"333601029962456490955627052893249127054",
"282248606686448189966090272585866638778",
"36159692925955900071296863865144051746"
]
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-f1b32431",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2817ac83cb4732597bf36853fe13ca616f4ee4e2",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_create_inline_data"
},
"signature_type": "Function",
"digest": {
"function_hash": "146434802082921205205130901881097404766",
"length": 1427.0
}
},
{
"signature_version": "v1",
"id": "CVE-2025-38701-fd0b0b98",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c",
"deprecated": false,
"target": {
"file": "fs/ext4/inline.c",
"function": "ext4_inline_data_truncate"
},
"signature_type": "Function",
"digest": {
"function_hash": "127513462518618869870384488155934678943",
"length": 2155.0
}
}
]