In the Linux kernel, the following vulnerability has been resolved:
ext4: guard against EA inode refcount underflow in xattr update
syzkaller found a path where ext4xattrinodeupdateref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like:
EXT4-fs error: EA inode <n> ref underflow: refcount=-1 refchange=-1 EXT4-fs warning: ea_inode dec ref err=-117
Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4errorinode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARNONCE() as negative refcounts are now impossible; keep error reporting in ext4error_inode().
This prevents the underflow and the follow-on orphan/cleanup churn.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/ee626f5d79d5817bb21d6f048dc0da4c4e383443/cves/2025/40xxx/CVE-2025-40190.json"
}[
{
"digest": {
"length": 970.0,
"function_hash": "51411089807093678428883886200878511338"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cfb3e4ddbdc8e02e637b8852540bd4718bf4814",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "ext4_xattr_inode_update_ref",
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-2d942158",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"220522425295742731575072092866494040125",
"284250044583377479161418216802723455325",
"146971194941982554928679784466756040211",
"116776601650315839082495634059920946254",
"165691213628111222076220098420456091524",
"85219675648143499849598542280819119621",
"311821118515592709462125564925770761524",
"110027616256613717617841465935751970042",
"63478375069779535510998600638822331327",
"123001843302953665256541041572116780059",
"249502640726217157339824120813395318112",
"113689279356357194179379189025279706881",
"285781485454742122133427852489347490657",
"117434933964506162181534263594706730322",
"316308941127305071163747617194695951108",
"178808624848828150370730159302748947633",
"334751635791585185909470408271020538230",
"227115145652738965617430486552439920544"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea39e712c2f5ae148ee5515798ae03523673e002",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-53c8917c",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"220522425295742731575072092866494040125",
"284250044583377479161418216802723455325",
"146971194941982554928679784466756040211",
"116776601650315839082495634059920946254",
"165691213628111222076220098420456091524",
"85219675648143499849598542280819119621",
"311821118515592709462125564925770761524",
"110027616256613717617841465935751970042",
"63478375069779535510998600638822331327",
"123001843302953665256541041572116780059",
"249502640726217157339824120813395318112",
"113689279356357194179379189025279706881",
"285781485454742122133427852489347490657",
"117434933964506162181534263594706730322",
"316308941127305071163747617194695951108",
"178808624848828150370730159302748947633",
"334751635791585185909470408271020538230",
"227115145652738965617430486552439920544"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@79ea7f3e11effe1bd9e753172981d9029133a278",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-728b3a9a",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"220522425295742731575072092866494040125",
"284250044583377479161418216802723455325",
"146971194941982554928679784466756040211",
"116776601650315839082495634059920946254",
"165691213628111222076220098420456091524",
"85219675648143499849598542280819119621",
"311821118515592709462125564925770761524",
"110027616256613717617841465935751970042",
"63478375069779535510998600638822331327",
"123001843302953665256541041572116780059",
"249502640726217157339824120813395318112",
"113689279356357194179379189025279706881",
"285781485454742122133427852489347490657",
"117434933964506162181534263594706730322",
"316308941127305071163747617194695951108",
"178808624848828150370730159302748947633",
"334751635791585185909470408271020538230",
"227115145652738965617430486552439920544"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57295e835408d8d425bef58da5253465db3d6888",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-7dbd11b4",
"signature_version": "v1"
},
{
"digest": {
"length": 970.0,
"function_hash": "51411089807093678428883886200878511338"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea39e712c2f5ae148ee5515798ae03523673e002",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "ext4_xattr_inode_update_ref",
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-7def55ce",
"signature_version": "v1"
},
{
"digest": {
"length": 970.0,
"function_hash": "51411089807093678428883886200878511338"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d6269028246f4484bfed403c947a114bb583631",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "ext4_xattr_inode_update_ref",
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-8622d2b7",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"220522425295742731575072092866494040125",
"284250044583377479161418216802723455325",
"146971194941982554928679784466756040211",
"116776601650315839082495634059920946254",
"165691213628111222076220098420456091524",
"85219675648143499849598542280819119621",
"311821118515592709462125564925770761524",
"110027616256613717617841465935751970042",
"63478375069779535510998600638822331327",
"123001843302953665256541041572116780059",
"249502640726217157339824120813395318112",
"113689279356357194179379189025279706881",
"285781485454742122133427852489347490657",
"117434933964506162181534263594706730322",
"316308941127305071163747617194695951108",
"178808624848828150370730159302748947633",
"334751635791585185909470408271020538230",
"227115145652738965617430486552439920544"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b879c4c6bbaab03c0ad2a983953bd1410bb165e",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-acf55e4d",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"220522425295742731575072092866494040125",
"284250044583377479161418216802723455325",
"146971194941982554928679784466756040211",
"116776601650315839082495634059920946254",
"165691213628111222076220098420456091524",
"85219675648143499849598542280819119621",
"311821118515592709462125564925770761524",
"110027616256613717617841465935751970042",
"63478375069779535510998600638822331327",
"123001843302953665256541041572116780059",
"249502640726217157339824120813395318112",
"113689279356357194179379189025279706881",
"285781485454742122133427852489347490657",
"117434933964506162181534263594706730322",
"316308941127305071163747617194695951108",
"178808624848828150370730159302748947633",
"334751635791585185909470408271020538230",
"227115145652738965617430486552439920544"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cfb3e4ddbdc8e02e637b8852540bd4718bf4814",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-be604f72",
"signature_version": "v1"
},
{
"digest": {
"length": 970.0,
"function_hash": "51411089807093678428883886200878511338"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@505e69f76ac497e788f4ea0267826ec7266b40c8",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "ext4_xattr_inode_update_ref",
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-c008063f",
"signature_version": "v1"
},
{
"digest": {
"length": 970.0,
"function_hash": "51411089807093678428883886200878511338"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@440b003f449a4ff2a00b08c8eab9ba5cd28f3943",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "ext4_xattr_inode_update_ref",
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-c7432569",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"220522425295742731575072092866494040125",
"284250044583377479161418216802723455325",
"146971194941982554928679784466756040211",
"116776601650315839082495634059920946254",
"165691213628111222076220098420456091524",
"85219675648143499849598542280819119621",
"311821118515592709462125564925770761524",
"110027616256613717617841465935751970042",
"63478375069779535510998600638822331327",
"123001843302953665256541041572116780059",
"249502640726217157339824120813395318112",
"113689279356357194179379189025279706881",
"285781485454742122133427852489347490657",
"117434933964506162181534263594706730322",
"316308941127305071163747617194695951108",
"178808624848828150370730159302748947633",
"334751635791585185909470408271020538230",
"227115145652738965617430486552439920544"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@505e69f76ac497e788f4ea0267826ec7266b40c8",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-d3faa81a",
"signature_version": "v1"
},
{
"digest": {
"length": 970.0,
"function_hash": "51411089807093678428883886200878511338"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b879c4c6bbaab03c0ad2a983953bd1410bb165e",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "ext4_xattr_inode_update_ref",
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-db0c0596",
"signature_version": "v1"
},
{
"digest": {
"length": 970.0,
"function_hash": "51411089807093678428883886200878511338"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57295e835408d8d425bef58da5253465db3d6888",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "ext4_xattr_inode_update_ref",
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-ec539c08",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"220522425295742731575072092866494040125",
"284250044583377479161418216802723455325",
"146971194941982554928679784466756040211",
"116776601650315839082495634059920946254",
"165691213628111222076220098420456091524",
"85219675648143499849598542280819119621",
"311821118515592709462125564925770761524",
"110027616256613717617841465935751970042",
"63478375069779535510998600638822331327",
"123001843302953665256541041572116780059",
"249502640726217157339824120813395318112",
"113689279356357194179379189025279706881",
"285781485454742122133427852489347490657",
"117434933964506162181534263594706730322",
"316308941127305071163747617194695951108",
"178808624848828150370730159302748947633",
"334751635791585185909470408271020538230",
"227115145652738965617430486552439920544"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d6269028246f4484bfed403c947a114bb583631",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-f3419c49",
"signature_version": "v1"
},
{
"digest": {
"length": 970.0,
"function_hash": "51411089807093678428883886200878511338"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@79ea7f3e11effe1bd9e753172981d9029133a278",
"signature_type": "Function",
"deprecated": false,
"target": {
"function": "ext4_xattr_inode_update_ref",
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-f5d9c6f5",
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"220522425295742731575072092866494040125",
"284250044583377479161418216802723455325",
"146971194941982554928679784466756040211",
"116776601650315839082495634059920946254",
"165691213628111222076220098420456091524",
"85219675648143499849598542280819119621",
"311821118515592709462125564925770761524",
"110027616256613717617841465935751970042",
"63478375069779535510998600638822331327",
"123001843302953665256541041572116780059",
"249502640726217157339824120813395318112",
"113689279356357194179379189025279706881",
"285781485454742122133427852489347490657",
"117434933964506162181534263594706730322",
"316308941127305071163747617194695951108",
"178808624848828150370730159302748947633",
"334751635791585185909470408271020538230",
"227115145652738965617430486552439920544"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@440b003f449a4ff2a00b08c8eab9ba5cd28f3943",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/ext4/xattr.c"
},
"id": "CVE-2025-40190-f87dfee3",
"signature_version": "v1"
}
]