CVE-2025-22121

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()

There's issue as follows:

BUG: KASAN: use-after-free in ext4_xattr_inode_dec_ref_all+0x6ff/0x790

Read of size 4 at addr ffff88807b003000 by task syz-executor.0/15172

CPU: 3 PID: 15172 Comm: syz-executor.0

Call Trace:

__dump_stack lib/dump_stack.c:82 [inline]

dump_stack+0xbe/0xfd lib/dump_stack.c:123

print_address_description.constprop.0+0x1e/0x280 mm/kasan/report.c:400

__kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560

kasan_report+0x3a/0x50 mm/kasan/report.c:585

ext4_xattr_inode_dec_ref_all+0x6ff/0x790 fs/ext4/xattr.c:1137

ext4_xattr_delete_inode+0x4c7/0xda0 fs/ext4/xattr.c:2896

ext4_evict_inode+0xb3b/0x1670 fs/ext4/inode.c:323

evict+0x39f/0x880 fs/inode.c:622

iput_final fs/inode.c:1746 [inline]

iput fs/inode.c:1772 [inline]

iput+0x525/0x6c0 fs/inode.c:1758

ext4_orphan_cleanup fs/ext4/super.c:3298 [inline]

ext4_fill_super+0x8c57/0xba40 fs/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References