CVE-2025-40119

Vulnerability

In the Linux kernel's ext4 filesystem, the function ext4_mb_init() initializes the multi-block allocator. During this initialization, if the slab cache allocation for group information fails, the code path calls ext4_mb_avg_fragment_size_destroy() on an uninitialized sbi->s_mb_avg_fragment_size structure. This function lacks a null pointer check, leading to a null pointer dereference and a kernel panic [1].

Exploitation

The vulnerability is triggered during the mount operation of an ext4 filesystem. An attacker would need the ability to trigger a memory allocation failure in the kernel, typically by exhausting system memory or by exploiting a controlled environment where slab allocations can be made to fail. No authentication is required beyond the ability to mount a filesystem, which may be possible from user space if the attacker has local access or can influence a privileged mount operation.

Impact

A successful exploit results in a kernel NULL pointer dereference, causing a system crash (denial of service). The crash trace shows the fault occurring in _raw_spin_lock_irqsave called from xa_destroy, which is invoked during the cleanup path. This can render the system unavailable until reboot.

Mitigation

The fix, committed to the Linux kernel stable tree, adds null pointer checks to both ext4_mb_avg_fragment_size_destroy() and ext4_mb_largest_free_orders_destroy() to prevent the dereference when the structures are uninitialized [1]. Users should apply the kernel patch or update to a version containing the fix. No workaround is available other than avoiding mount operations under memory pressure.