CVE-2025-23150 Overview
CVE-2025-23150 is an off-by-one error [CWE-193] in the Linux kernel's ext4 filesystem implementation. The flaw resides in the do_split function within fs/ext4/namei.c and leads to a use-after-free condition in ext4_insert_dentry. Syzkaller, operated by the Linux Verification Center (linuxtesting.org), discovered the issue through kernel fuzzing. A local authenticated user can trigger out-of-bounds memory access by creating directory entries with long filenames, causing kernel memory corruption and system crashes.
Critical Impact
Local attackers with low privileges can trigger kernel memory corruption in ext4 directory operations, resulting in denial of service through use-after-free conditions affecting system availability.
Affected Products
- Linux Kernel (multiple versions including 5.9 release candidates and 6.15-rc1)
- Debian Linux 11.0
- Systems using the ext4 filesystem with directory indexing enabled
Discovery Timeline
- 2025-05-01 - CVE-2025-23150 published to NVD
- 2025-11-05 - Last updated in NVD database
Technical Details for CVE-2025-23150
Vulnerability Analysis
The vulnerability is an off-by-one error [CWE-193] in the ext4 filesystem's directory splitting logic. When ext4 converts a linear directory into an indexed directory through make_indexed_dir, it calls do_split to redistribute directory entries across two blocks. The split logic iterates backward through entries to determine the split point.
The loop variable i can decrement to -1 when the sum of active entries does not exceed half the block size. The original implementation also performed a split if the cumulative size exceeded the threshold at the final iteration. With many long filename entries packed into a single block, this miscalculation produces an invalid split position.
The faulty split position causes ext4_insert_dentry to write 251 bytes outside the intended directory entry buffer. KASAN reports the resulting use-after-free at ext4_insert_dentry+0x36a/0x6d0 in fs/ext4/namei.c:2109, triggered via vfs_symlink and do_symlinkat system call paths.
Root Cause
The root cause is incorrect boundary handling in the entry distribution loop within do_split. The loop condition allowed the iterator to reach -1, and the subsequent comparison did not account for the case where all entries should remain in the original block. This boundary miscalculation produced an invalid split offset when blocks contained many long-named entries.
Attack Vector
Exploitation requires local access with low privileges (CVSS vector AV:L/PR:L). An attacker invokes filesystem operations such as symlink(), mkdir(), or creat() to create directory entries with long filenames in a target directory. When the directory transitions from linear to indexed format, the flawed do_split logic triggers out-of-bounds memory writes. The impact is restricted to availability, producing kernel panics or system instability rather than confidentiality or integrity compromise.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2025-23150
Indicators of Compromise
- Kernel log entries containing KASAN: use-after-free in ext4_insert_dentry on instrumented builds
- Unexpected kernel panics or oops messages referencing ext4_insert_dentry, add_dirent_to_buf, or make_indexed_dir
- System crashes correlated with workloads that create many files with long filenames in a single directory
Detection Strategies
- Monitor dmesg and /var/log/kern.log for ext4 namei.c stack traces and KASAN reports on test systems
- Audit running kernel versions against the patched commits listed in the kernel.org stable tree
- Track filesystem-related syscall anomalies including bursts of symlink, creat, and rename operations from unprivileged users
Monitoring Recommendations
- Collect kernel ring buffer messages centrally through journald forwarding or syslog to detect ext4 crash signatures
- Establish baselines for symlink and directory creation rates per user to identify unusual filesystem activity
- Enable kernel crash dump collection (kdump) to capture forensic evidence of ext4 panics for root cause analysis
How to Mitigate CVE-2025-23150
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits, including 16d9067f, 17df39f4, and 2883e9e7
- For Debian 11 systems, install kernel updates from the Debian LTS security advisories
- Restrict local shell access on multi-tenant systems until patched kernels are deployed
- Reboot systems after kernel package upgrades to load the patched image
Patch Information
The Linux kernel maintainers released fixes across multiple stable branches. Patch commits are available in the kernel.org stable tree, including Kernel Patch Commit 16d9067, Kernel Patch Commit 2883e9e7, and Kernel Patch Commit b96bd2c3. Debian users should reference Debian LTS Announcement #30 and Debian LTS Announcement #45 for distribution-specific package versions.
Workarounds
- Limit untrusted local user access to filesystems where they can create directories with many long-named entries
- Apply mandatory access controls through SELinux or AppArmor to restrict filesystem operations from low-privilege accounts
- Consider mounting user-writable filesystems with quotas to limit the number of entries per directory where feasible
# Verify the running kernel version against patched releases
uname -r
# Debian: update and install patched kernel package
sudo apt update
sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
# Reboot to activate the patched kernel
sudo systemctl reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
