CVE-2025-68264

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: refresh inline data size before write operations

The cached ei->i_inline_size can become stale between the initial size

check and when ext4_update_inline_data()/ext4_create_inline_data() use

it. Although ext4_get_max_inline_size() reads the correct value at the

time of the check, concurrent xattr operations can modify i_inline_size

before ext4_write_lock_xattr() is acquired.

This causes ext4_update_inline_data() and ext4_create_inline_data() to

work with stale capacity values, leading to a BUG_ON() crash in

ext4_write_inline_data():

kernel BUG at fs/ext4/inline.c:1331!

BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);

The race window:

1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)

2. Size check passes for 50-byte write

3. [Another thread adds xattr, i_inline_size changes to 40]

4. ext4_write_lock_xattr() acquires lock

5. ext4_update_inline_data() uses stale i_inline_size = 60

6. Attempt

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References