CVE-2025-40179

The ext4 filesystem in the Linux kernel did not enforce a size limit on the orphan file, which is used to track inodes with pending operations. During orphan replay, the kernel traverses the entire orphan file and pins all its buffers in memory. An arbitrarily large orphan file could therefore lead to excessive memory consumption.

An attacker who can create or modify a filesystem image with a very large orphan file (e.g., by mounting a malicious ext4 image) could trigger this condition. No special privileges are required beyond the ability to mount a crafted filesystem.

The impact is a denial of service (DoS) through memory exhaustion, potentially causing system instability or crashes. The fix, as described in the kernel commits [1][2], limits the orphan file size to a sane value and uses kvmalloc() for allocating block descriptor arrays to avoid large order allocations. The patch has been applied to the stable kernel branches.