CVE-2025-68264ext4: refresh inline data size before write operations
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ext4: refresh inline data size before write operations The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired. This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data(): kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); The race window: 1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct) 2. Size check passes for 50-byte write 3. [Another thread adds xattr, i_inline_size changes to 40] 4. ext4_write_lock_xattr() acquires lock 5. ext4_update_inline_data() uses stale i_inline_size = 60 6. Attempts to write 50 bytes but only 40 bytes actually available 7. BUG_ON() triggers Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications. This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.
Timeline
ID reserved
By Linux
Published
- 11 months later
· 11 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Deferred.
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 67cf5b09a46f72e048501b84996f2f77bc42e947 – < 54ab81ae5f218452e64470cd8a8139bb5880fe2b
- affected 67cf5b09a46f72e048501b84996f2f77bc42e947 – < 43bf001f0fe4e59bba47c897505222f959f4a1cc
- affected 67cf5b09a46f72e048501b84996f2f77bc42e947 – < 89c2c41f0974e530b2d032c3695095aa0559adb1
- affected 67cf5b09a46f72e048501b84996f2f77bc42e947 – < 1687a055a555347b002f406676a1aaae4668f242
- affected 67cf5b09a46f72e048501b84996f2f77bc42e947 – < 210ac60a86a3ad2c76ae60e0dc71c34af6e7ea0b
- affected 67cf5b09a46f72e048501b84996f2f77bc42e947 – < ca43ea29b4c4d2764aec8a26cffcfb677a871e6e
- affected 67cf5b09a46f72e048501b84996f2f77bc42e947 – < 58df743faf21ceb1880f930aa5dd428e2a5e415d
- affected 67cf5b09a46f72e048501b84996f2f77bc42e947 – < 892e1cf17555735e9d021ab036c36bc7b58b0e3b
- affected 3.8
- unaffected < 3.8
- unaffected 5.10.248 – ≤ 5.10.*
- unaffected 5.15.198 – ≤ 5.15.*
- unaffected 6.1.160 – ≤ 6.1.*
- unaffected 6.6.120 – ≤ 6.6.*
- unaffected 6.12.62 – ≤ 6.12.*
- unaffected 6.17.12 – ≤ 6.17.*
- unaffected 6.18.1 – ≤ 6.18.*
- unaffected 6.19 – ≤ *
References
References10
- https://git.kernel.org/stable/c/54ab81ae5f218452e64470cd8a8139bb5880fe2b (opens in a new tab)
- https://git.kernel.org/stable/c/43bf001f0fe4e59bba47c897505222f959f4a1cc (opens in a new tab)
- https://git.kernel.org/stable/c/89c2c41f0974e530b2d032c3695095aa0559adb1 (opens in a new tab)
- https://git.kernel.org/stable/c/1687a055a555347b002f406676a1aaae4668f242 (opens in a new tab)
- https://git.kernel.org/stable/c/210ac60a86a3ad2c76ae60e0dc71c34af6e7ea0b (opens in a new tab)
- https://git.kernel.org/stable/c/ca43ea29b4c4d2764aec8a26cffcfb677a871e6e (opens in a new tab)
- https://git.kernel.org/stable/c/58df743faf21ceb1880f930aa5dd428e2a5e415d (opens in a new tab)
- https://git.kernel.org/stable/c/892e1cf17555735e9d021ab036c36bc7b58b0e3b (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-203738 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-68264)Record last updated .