CVE-2025-40119: ext4: fix potential null deref in ext4_mb_init()
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix potential null deref in ext4mbinit()
In ext4mbinit(), ext4mbavgfragmentsizedestroy() may be called when sbi->smbavgfragmentsize remains uninitialized (e.g., if groupinfo slab cache allocation fails). Since ext4mbavgfragmentsizedestroy() lacks null pointer checking, this leads to a null pointer dereference.
================================================================== EXT4-fs: no memory for groupinfo slab cache BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0002 [#1] SMP PTI CPU:2 UID: 0 PID: 87 Comm:mount Not tainted 6.17.0-rc2 #1134 PREEMPT(none) RIP: 0010:rawspinlockirqsave+0x1b/0x40 Call Trace: <TASK> xadestroy+0x61/0x130 ext4mbinit+0x483/0x540 ext4fillsuper+0x116d/0x17b0 ext4fillsuper+0xd3/0x280 gettreebdevflags+0x132/0x1d0 vfsgettree+0x29/0xd0 donewmount+0x197/0x300 x64sysmount+0x116/0x150 dosyscall64+0x50/0x1c0 entrySYSCALL64afterhwframe+0x76/0x7e ==================================================================
Therefore, add necessary null check to ext4mbavgfragmentsizedestroy() to prevent this issue. The same fix is also applied to ext4mblargestfreeordersdestroy().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40119?
The severity of CVE-2025-40119 has not been specifically rated but vulnerabilities in the Linux kernel often have a significant impact based on their context.
How do I fix CVE-2025-40119?
To fix CVE-2025-40119, update your Linux kernel to version 6.17.0-rc3 or later where the vulnerability has been resolved.
What are the potential impacts of CVE-2025-40119?
The potential impacts include instability or crashes in systems relying on uninitialized memory in ext4 file systems.
Which versions of the Linux kernel are affected by CVE-2025-40119?
CVE-2025-40119 affects Linux kernel version 6.17.0-rc2.
Is CVE-2025-40119 exploitable remotely?
There is no indication that CVE-2025-40119 is remotely exploitable, as it generally affects local file system operations.