CVE-2025-38701: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr
ext4: do not BUG when INLINEDATAFL lacks system.data xattr
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In ext4_update_inline_data(), ext4_create_inline_data(), and ext4_inline_data_truncate(), replace BUG_ON handling with EXT4_ERROR_INODE() so a missing system.data extended attribute is reported as a corrupted file system instead of triggering a kernel BUG.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38701?
CVE-2025-38701 has been classified with a moderate severity rating due to the potential disruption it can cause in the ext4 file system.
How do I fix CVE-2025-38701?
To fix CVE-2025-38701, you should update your Linux kernel to the latest version where this vulnerability has been patched.
What is the impact of CVE-2025-38701 on the Linux kernel?
The impact of CVE-2025-38701 can lead to unexpected behavior or crashes when ext4 filesystems attempt to handle inline data incorrectly.
Is CVE-2025-38701 associated with any specific Linux kernel versions?
CVE-2025-38701 affects specific implementations of the Linux kernel but details on affected versions should be verified with the kernel release notes.
Who reported CVE-2025-38701?
CVE-2025-38701 was reported through syzbot, which is a tool that fuzz tests the Linux kernel to identify vulnerabilities.