CVE-2025-22121 Overview
CVE-2025-22121 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's ext4 filesystem. The flaw resides in the ext4_xattr_inode_dec_ref_all() function within fs/ext4/xattr.c. It is triggered when ext4_xattr_delete_inode() fails to validate extended attributes stored inside an inode before dereferencing them. A crafted or corrupted ext4 filesystem image mounted on a vulnerable host can trigger a use-after-free style read, detected by KASAN. The issue affects local users who can mount filesystem images or interact with corrupted ext4 volumes.
Critical Impact
Local attackers with mount capability can crash the kernel or leak sensitive memory contents by mounting a malformed ext4 image containing invalid inline extended attributes.
Affected Products
- Linux Kernel (multiple stable branches prior to the fix commits)
- Downstream distributions shipping vulnerable kernel versions
- Siemens industrial products referenced in advisory SSA-019113
Discovery Timeline
- 2025-04-16 - CVE-2025-22121 published to the National Vulnerability Database
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2025-22121
Vulnerability Analysis
The vulnerability exists in the ext4 extended attribute (xattr) handling code. When the kernel processes an inode during eviction, ext4_xattr_delete_inode() calls ext4_xattr_inode_dec_ref_all() to decrement reference counts on external xattr inodes. The path does not verify that inline xattrs stored inside the inode body are structurally valid before iterating over them.
When a malformed ext4 image is mounted, the orphan cleanup path in ext4_fill_super() calls iput() on inodes with corrupted xattr regions. The subsequent xattr walk reads beyond the allocated inode buffer, producing the KASAN use-after-free report at offset +0x6ff/0x790 in ext4_xattr_inode_dec_ref_all.
Root Cause
The root cause is missing validation of inline xattr metadata. ext4_xattr_delete_inode() assumes the xattr entries encoded within the inode are well-formed. The upstream fix moves validation earlier by calling xattr_check_inode() directly inside ext4_iget_extra_inode(). Centralizing the check eliminates divergent verification paths and ensures every inode load rejects malformed xattr content before any consumer walks it.
Attack Vector
Exploitation requires local access with the ability to mount a filesystem image. An attacker crafts an ext4 image containing an inode with malformed inline xattr entries and triggers mount. During orphan cleanup or subsequent inode eviction, the out-of-bounds read fires. The likely outcome is a kernel panic causing denial of service, though out-of-bounds reads can also leak adjacent kernel memory in some configurations. The CVSS vector indicates local attack vector, low complexity, low privileges required, and high impact to confidentiality and availability.
No public proof-of-concept exploit is currently available, and the reproducer originates from the syzkaller fuzzer (syz-executor).
Detection Methods for CVE-2025-22121
Indicators of Compromise
- KASAN reports referencing use-after-free in ext4_xattr_inode_dec_ref_all in dmesg or kernel logs
- Unexpected kernel panics or oopses during ext4 mount operations, especially on removable media or user-supplied images
- Orphan cleanup errors originating from ext4_fill_super followed by inode eviction crashes
Detection Strategies
- Enable KASAN on test kernels to surface out-of-bounds reads in xattr handling paths
- Audit kernel version banners across the fleet and compare against fixed stable branches referenced in the kernel.org commits
- Correlate mount syscalls from non-root or container contexts with subsequent kernel crash telemetry
Monitoring Recommendations
- Forward /var/log/kern.log and journald kernel messages to a centralized log platform for pattern matching on ext4_xattr faults
- Monitor uses of mount(2), CAP_SYS_ADMIN, and user-namespace filesystem mounts by unprivileged processes
- Track loading of ext4 images from USB, loop devices, or container image layers as high-signal events
How to Mitigate CVE-2025-22121
Immediate Actions Required
- Apply the vendor kernel update containing the upstream fix commits from kernel.org stable trees
- Restrict the ability of unprivileged users and containers to mount arbitrary ext4 filesystems
- For Siemens deployments, review and apply guidance in Siemens Security Advisory SSA-019113
Patch Information
The fix has been merged across multiple stable branches. Reference commits include kernel commit 098927a, kernel commit 0c8fbb6, kernel commit 2720245, kernel commit 3c59135, kernel commit 5701875, kernel commit b374e9e, and kernel commit c000a8a. Consult your distribution's security advisories for backported package versions.
Workarounds
- Disable automatic mounting of removable media and untrusted filesystem images at the desktop and udev layer
- Configure fstab and container runtimes to prohibit user-controlled ext4 mounts until the kernel is patched
- Where feasible, disable user namespaces for unprivileged users to prevent unprivileged mount operations
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
