CVE-2025-40190

Vulnerability

In the Linux kernel's ext4 filesystem, the function ext4_xattr_inode_update_ref() in fs/ext4/xattr.c updates the reference count of an inode's refcount without first verifying that the current refcount is positive. When ext4_xattr_inode_update_ref() reads a refcount that is already <= 0 and then applies a ref_change (often -1), the refcount can underflow to -1. This triggers errors like EXT4-fs error: EA inode ref underflow: ref_count=-1 ref_change=-1 and EXT4-fs warning: ea_inode dec ref err=-117 [1].

Exploitation

The vulnerability is triggered during xattr update operations on an ext4 filesystem. An attacker with the ability to mount a crafted ext4 filesystem (e or to trigger xattr operations on a filesystem with corrupted EA inodes can cause the refcount underflow. No special privileges are required beyond the ability to perform xattr operations on the filesystem [2]. ].

Impact

An attacker can cause a refcount underflow, leading to filesystem corruption and potential denial of service. The kernel may emit error messages and the filesystem may become inconsistent, potentially requiring fsck to repair. The underflow can also lead to orphan inode cleanup churn [1].

Mitigation

The fix adds an explicit check: if the current refcount is non-positive, treat it as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. The WARN_ONCE() is removed as negative refcounts are now impossible. The patch has been applied to the stable kernel tree [1][2][3].