CVE-2025-22113

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid journaling sb update on error if journal is destroying

Presently we always BUG_ON if trying to start a transaction on a journal marked

with JBD2_UNMOUNT, since this should never happen. However, while ltp running

stress tests, it was observed that in case of some error handling paths, it is

possible for update_super_work to start a transaction after the journal is

destroyed eg:

(umount)

ext4_kill_sb

kill_block_super

generic_shutdown_super

sync_filesystem /* commits all txns */

evict_inodes

/* might start a new txn */

ext4_put_super

flush_work(&sbi->s_sb_upd_work) /* flush the workqueue */

jbd2_journal_destroy

journal_kill_thread

journal->j_flags |= JBD2_UNMOUNT;

jbd2_journal_commit_transaction

jbd2_journal_get_descriptor_buffer

jbd2_journal_bmap

ext4_journal_bmap

ext4_map_b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References