CVE-2025-38220
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38220
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38220.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-38220
- Downstream
- Related
- Published
- 2025-07-04T13:37:36Z
- Modified
- 2025-10-18T03:53:20.959300Z
- Summary
- ext4: only dirty folios when data journaling regular files
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ext4: only dirty folios when data journaling regular files
fstest generic/388 occasionally reproduces a crash that looks as follows:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> ext4blockzeropagerange+0x30c/0x380 [ext4] ext4truncate+0x436/0x440 [ext4] ext4processorphan+0x5d/0x110 [ext4] ext4orphancleanup+0x124/0x4f0 [ext4] ext4fillsuper+0x262d/0x3110 [ext4] gettreebdevflags+0x132/0x1d0 vfsgettree+0x26/0xd0 vfscmdcreate+0x59/0xe0 _dosysfsconfig+0x4ed/0x6b0 dosyscall_64+0x82/0x170 ...
This occurs when processing a symlink inode from the orphan list. The partial block zeroing code in the truncate path calls ext4dirtyjournalleddata() -> foliomarkdirty(). The latter calls mapping->aops->dirtyfolio(), but symlink inodes are not assigned an aops vector in ext4, hence the crash.
To avoid this problem, update the ext4dirtyjournalleddata() helper to only mark the folio dirty on regular files (for which aops is assigned). This also matches the journaling logic in the ext4symlink() creation path, where ext4handledirtymetadata() is called directly.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/be5f3061a6f904e3674257879e71881ceee5b673
- https://git.kernel.org/stable/c/cf6a4c4ac7b6e3214f25df594c9689a62f1bb456
- https://git.kernel.org/stable/c/d7af6eee8cd60f55aa8c5fe2b91f11ec0c9a0f27
- https://git.kernel.org/stable/c/e26268ff1dcae5662c1b96c35f18cfa6ab73d9de
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd84c9ebdac1e39bc7b036c0c829ee8c1956edabcFixedcf6a4c4ac7b6e3214f25df594c9689a62f1bb456
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd84c9ebdac1e39bc7b036c0c829ee8c1956edabcFixedbe5f3061a6f904e3674257879e71881ceee5b673
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd84c9ebdac1e39bc7b036c0c829ee8c1956edabcFixedd7af6eee8cd60f55aa8c5fe2b91f11ec0c9a0f27
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd84c9ebdac1e39bc7b036c0c829ee8c1956edabcFixede26268ff1dcae5662c1b96c35f18cfa6ab73d9de