CVE-2025-40190 — Integer Underflow (Wrap or Wraparound) in Linux
Severity
6.1MEDIUM
No vectorEPSS
0.1%
top 82.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 12
Latest updateNov 13
Description
In the Linux kernel, the following vulnerability has been resolved:
ext4: guard against EA inode refcount underflow in xattr update
syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA
inode refcount that is already ref underflow: ref_count=-1 ref_change=-1
EXT4-fs warning: ea_inode dec ref err=-117
Make the invariant explicit: if the current refcount is non-positive,
treat this as on-disk corruption, emit ext4_error_inode(), and fail the
operation with -EFSCORRUPTED instead…
Affected Packages6 packages
▶CVEListV5linux/linux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 — ea39e712c2f5ae148ee5515798ae03523673e002+7
🔴Vulnerability Details
3GHSA▶
GHSA-j9x6-gmq6-xm5x: In the Linux kernel, the following vulnerability has been resolved:
ext4: guard against EA inode refcount underflow in xattr update
syzkaller found↗2025-11-13
OSV▶
CVE-2025-40190: In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a↗2025-11-12