CVE-2025-37738

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry. This fixes the following KASAN reported issue: ================================================================== BUG: KASAN: slab-use-after-free in ext4_xattr_inode_dec_ref_all+0xb8c/0xe90 Read of size 4 at addr ffff888012c120c4 by task repro/2065 CPU: 1 UID: 0 PID: 2065 Comm: repro Not tainted 6.13.0-rc2+ #11 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebui...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= e50e5129f384ae282adebfb561189cdb19b81cee < 6aff941cb0f7d0c897c3698ad2e30672709135e3, >= e50e5129f384ae282adebfb561189cdb19b81cee < 76c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3, >= e50e5129f384ae282adebfb561189cdb19b81cee < f737418b6de31c962c7192777ee4018906975383, >= e50e5129f384ae282adebfb561189cdb19b81cee < cf9291a3449b04688b81e32621e88de8f4314b54, >= e50e5129f384ae282adebfb561189cdb19b81cee < 362a90cecd36e8a5c415966d0b75b04a0270e4dd, >= e50e5129f384ae282adebfb561189cdb19b81cee < eb59cc31b6ea076021d14b04e7faab1636b87d0e, >= e50e5129f384ae282adebfb561189cdb19b81cee < 3bc6317033f365ce578eb6039445fb66162722fd, >= e50e5129f384ae282adebfb561189cdb19b81cee < 836e625b03a666cf93ff5be328c8cb30336db872, >= e50e5129f384ae282adebfb561189cdb19b81cee < c8e008b60492cf6fd31ef127aea6d02fd3d314cd, >= 4.13, < 5.4.293, >= 5.5 < 5.10.237, >= 5.11 < 5.15.181, >= 5.16 < 6.1.135, >= 6.2 < 6.6.88, >= 6.7 < 6.12.24, >= 6.13 < 6.13.12, >= 6.14 < 6.14.3, 11.0

Fixed versions

5.4.293, 5.10.237, 5.15.181, 6.1.135, 6.6.88, 6.12.24, 6.13.12, 6.14.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416