CVE-2025-38580 (GCVE-0-2025-38580)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:03 – Updated: 2026-08-05 12:03
VLAI
Title
ext4: fix inode use after free in ext4_end_io_rsv_work()
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode use after free in ext4_end_io_rsv_work() In ext4_io_end_defer_completion(), check if io_end->list_vec is empty to avoid adding an io_end that requires no conversion to the i_rsv_conversion_list, which in turn prevents starting an unnecessary worker. An ext4_emergency_state() check is also added to avoid attempting to abort the journal in an emergency state. Additionally, ext4_put_io_end_defer() is refactored to call ext4_io_end_defer_completion() directly instead of being open-coded. This also prevents starting an unnecessary worker when EXT4_IO_END_FAILED is set but data_err=abort is not enabled. This ensures that the check in ext4_put_io_end_defer() is consistent with the check in ext4_end_bio(). Otherwise, we might add an io_end to the i_rsv_conversion_list and then call ext4_finish_bio(), after which the inode could be freed before ext4_end_io_rsv_work() is called, triggering a use-after-free issue.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5d , < ac999862b98a0f49e858e509f776be51406f1e77 (git)
Affected: ce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5d , < 469c44e66e2110054949609dde095788320139d0 (git)
Affected: ce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5d , < c678bdc998754589cea2e6afab9401d7d8312ac4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.15.10 , ≤ 6.15.* (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/page-io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ac999862b98a0f49e858e509f776be51406f1e77",
              "status": "affected",
              "version": "ce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5d",
              "versionType": "git"
            },
            {
              "lessThan": "469c44e66e2110054949609dde095788320139d0",
              "status": "affected",
              "version": "ce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5d",
              "versionType": "git"
            },
            {
              "lessThan": "c678bdc998754589cea2e6afab9401d7d8312ac4",
              "status": "affected",
              "version": "ce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/page-io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix inode use after free in ext4_end_io_rsv_work()\n\nIn ext4_io_end_defer_completion(), check if io_end-\u003elist_vec is empty to\navoid adding an io_end that requires no conversion to the\ni_rsv_conversion_list, which in turn prevents starting an unnecessary\nworker. An ext4_emergency_state() check is also added to avoid attempting\nto abort the journal in an emergency state.\n\nAdditionally, ext4_put_io_end_defer() is refactored to call\next4_io_end_defer_completion() directly instead of being open-coded.\nThis also prevents starting an unnecessary worker when EXT4_IO_END_FAILED\nis set but data_err=abort is not enabled.\n\nThis ensures that the check in ext4_put_io_end_defer() is consistent with\nthe check in ext4_end_bio(). Otherwise, we might add an io_end to the\ni_rsv_conversion_list and then call ext4_finish_bio(), after which the\ninode could be freed before ext4_end_io_rsv_work() is called, triggering\na use-after-free issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered by ordinary buffered writes to a file on a locally mounted ext4 filesystem, reached through the write()/writeback path with no network protocol involved. Filesystem writeback bugs of this class are local-access only.\nAC:L - The vulnerable predicate mismatch is hit under the default data_err=ignore mount option with no rare config required, and the attacker controls the decisive side of the race \u2014 after ext4_finish_bio() clears writeback, they force inode eviction via unlink+close while stalling the rsv_conversion workqueue. Writeback bio failures are themselves inducible locally (dm-thin/thin-pool ENOSPC by writing data, network block devices, removable media, worn eMMC on embedded/automotive).\nPR:L - Any unprivileged local user with write access to any ext4 filesystem (home directory, /tmp, a container overlay upper dir) can drive buffered writeback into ext4_end_bio(). No capability, ioctl, mount privilege, or user-namespace trick is needed.\nUI:N - The attacker writes and unlinks their own files and triggers eviction themselves; no victim action, no mounting of a crafted image, and no cooperation from another user is required.\nS:U - The freed ext4_inode_info and the dangling io_end-\u003einode dereference are both kernel objects in the same security authority as the attacking process, with no VM, IOMMU, or sandbox boundary crossed. This is standard local kernel memory corruption.\nC:H - ext4_end_io_end() reads the freed inode\u0027s i_sb and dereferences EXT4_SB(sb)-\u003es_journal, so grooming the reclaimed ext4_inode_cachep slot turns the stale pointer into an attacker-directed kernel read that can be used for disclosure. Per kernel scoring guidance a use-after-free giving control over freed object contents is High.\nI:H - The worker performs writes into freed memory \u2014 process_one_work() updates work-\u003edata, and ext4_do_flush_completed_IO() takes i_completed_io_lock and does list_replace_init() on the freed list head \u2014 so a reallocated live inode has its i_rsv_conversion_list hijacked, yielding list corruption and io_end double-free primitives suitable for control-flow hijacking.\nA:H - Even unexploited, the use-after-free reliably produces a KASAN splat, oops, or panic in ext4_end_io_rsv_work(), and taking a spinlock inside freed/reused memory can hang the rsv_conversion workqueue. Any kernel crash is scored High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:07.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ac999862b98a0f49e858e509f776be51406f1e77"
        },
        {
          "url": "https://git.kernel.org/stable/c/469c44e66e2110054949609dde095788320139d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c678bdc998754589cea2e6afab9401d7d8312ac4"
        }
      ],
      "title": "ext4: fix inode use after free in ext4_end_io_rsv_work()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38580",
    "datePublished": "2025-08-19T17:03:03.018Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2026-08-05T12:03:07.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38580",
      "date": "2026-10-02",
      "epss": "0.00162",
      "percentile": "0.04924"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ext4/page-io.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ac999862b98a0f49e858e509f776be51406f1e77",
                    "status": "affected",
                    "version": "ce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "469c44e66e2110054949609dde095788320139d0",
                    "status": "affected",
                    "version": "ce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c678bdc998754589cea2e6afab9401d7d8312ac4",
                    "status": "affected",
                    "version": "ce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ext4/page-io.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2EA7D98E-F04C-44BE-AC61-F5ADC4C88EC6",
                    "versionEndExcluding": "6.15.10",
                    "versionStartIncluding": "6.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB",
                    "versionEndExcluding": "6.16.1",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix inode use after free in ext4_end_io_rsv_work()\n\nIn ext4_io_end_defer_completion(), check if io_end-\u003elist_vec is empty to\navoid adding an io_end that requires no conversion to the\ni_rsv_conversion_list, which in turn prevents starting an unnecessary\nworker. An ext4_emergency_state() check is also added to avoid attempting\nto abort the journal in an emergency state.\n\nAdditionally, ext4_put_io_end_defer() is refactored to call\next4_io_end_defer_completion() directly instead of being open-coded.\nThis also prevents starting an unnecessary worker when EXT4_IO_END_FAILED\nis set but data_err=abort is not enabled.\n\nThis ensures that the check in ext4_put_io_end_defer() is consistent with\nthe check in ext4_end_bio(). Otherwise, we might add an io_end to the\ni_rsv_conversion_list and then call ext4_finish_bio(), after which the\ninode could be freed before ext4_end_io_rsv_work() is called, triggering\na use-after-free issue."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: se corrige el uso de inodo use after free en ext4_end_io_rsv_work() En ext4_io_end_defer_completion(), se comprueba si io_end-\u0026gt;list_vec est\u00e1 vac\u00edo para evitar a\u00f1adir un io_end que no requiere conversi\u00f3n a i_rsv_conversion_list, lo que a su vez impide iniciar un trabajador innecesario. Tambi\u00e9n se a\u00f1ade una comprobaci\u00f3n ext4_emergency_state() para evitar intentar abortar el diario en un estado de emergencia. Adem\u00e1s, ext4_put_io_end_defer() se refactoriza para llamar a ext4_io_end_defer_completion() directamente en lugar de estar en c\u00f3digo abierto. Esto tambi\u00e9n impide iniciar un trabajador innecesario cuando EXT4_IO_END_FAILED est\u00e1 configurado pero data_err=abort no est\u00e1 habilitado. Esto garantiza que la comprobaci\u00f3n en ext4_put_io_end_defer() sea coherente con la comprobaci\u00f3n en ext4_end_bio(). De lo contrario, podr\u00edamos agregar un io_end a i_rsv_conversion_list y luego llamar a ext4_finish_bio(), despu\u00e9s de lo cual el inodo podr\u00eda liberarse antes de que se llame a ext4_end_io_rsv_work(), lo que desencadenar\u00eda un problema de use-after-free."
          }
        ],
        "id": "CVE-2025-38580",
        "lastModified": "2026-07-30T06:23:28.383",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-08-19T17:15:35.160",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/469c44e66e2110054949609dde095788320139d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ac999862b98a0f49e858e509f776be51406f1e77"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c678bdc998754589cea2e6afab9401d7d8312ac4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:26:10+00:00",
      "cve": "CVE-2025-38580",
      "id": "CVE-2025-38580",
      "initial_release_date": "2025-08-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: fix inode use after free in ext4_end_io_rsv_work()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38580.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T00:19:25Z",
      "cve": "CVE-2025-38580",
      "id": "CVE-2025-38580",
      "initial_release_date": "2025-08-19T23:23:32Z",
      "product_status:known_not_affected": "524",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38580",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38580.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.