CVE-2025-40233

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUGON in ocfs2refcountcalcow_clusters().

The problem occurs when: 1. copyfilerange() creates a reflinked extent with OCFS2EXTREFCOUNTED 2. ioctl(FITRIM) triggers ocfs2moveextents() 3. __ocfs2moveextents_range() reads and caches the extent (flags=0x2) 4. ocfs2moveextent()/ocfs2defragextent() calls __ocfs2moveextent() which clears OCFS2EXTREFCOUNTED flag on disk (flags=0x0) 5. The extent map cache is not invalidated after the move 6. Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch 7. BUGON(!(rec->eflags & OCFS2EXTREFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in _ocfs2moveextentsrange(). This ensures subsequent operations read fresh extent data from disk.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40233.json",
    "cna_assigner": "Linux"
}

References

Affected packages

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

5.4.301

Type: ECOSYSTEM
Events: Introduced

5.5.0

Fixed

5.10.246

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.196

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.158

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.115

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.56

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.17.6

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40233.json"