CVE-2025-68820: Linux Kernel ext4 Null Pointer Vulnerability

CVE-2025-68820 Overview

A null pointer dereference vulnerability has been discovered in the Linux kernel's ext4 filesystem extended attribute (xattr) handling code. The vulnerability exists in the ext4_raw_inode() function and can be triggered when ext4_get_inode_loc() fails with an error such as -EFSCORRUPTED. When this failure occurs, the iloc.bh buffer head remains set to NULL, and the subsequent call to ext4_raw_inode() from ext4_xattr_inode_dec_ref_all() will dereference this null pointer due to missing error checking.

This vulnerability was discovered by Linux Verification Center (linuxtesting.org) using the SVACE static analysis tool.

Critical Impact

Exploitation of this vulnerability could lead to a kernel panic or system crash, resulting in denial of service conditions on affected Linux systems using ext4 filesystems.

Affected Products

• Linux kernel with ext4 filesystem support
• Systems using extended attributes (xattr) on ext4 filesystems
• Multiple kernel versions prior to the security patches

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-68820 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68820

Vulnerability Analysis

The vulnerability resides in the ext4 extended attribute handling code within the Linux kernel. When performing extended attribute operations that involve inode reference counting, the function ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to retrieve the inode location information. This function populates an ext4_iloc structure, including the bh (buffer head) member.

Under certain error conditions, such as filesystem corruption detected by the kernel (returning -EFSCORRUPTED), the ext4_get_inode_loc() function fails without initializing iloc.bh, leaving it as NULL. The ext4_xattr_inode_dec_ref_all() function lacks proper error checking for this failure condition and proceeds to call ext4_raw_inode() with the uninitialized structure, resulting in a null pointer dereference when attempting to access the buffer head.

Root Cause

The root cause is insufficient error handling in the ext4_xattr_inode_dec_ref_all() function. The code path does not validate the return value of ext4_get_inode_loc() before proceeding to use the iloc structure. When the function encounters filesystem corruption or other errors, it returns an error code but the caller ignores this and continues execution with invalid data, specifically a NULL buffer head pointer.

Attack Vector

The attack vector requires local access to a system with an ext4 filesystem. An attacker could potentially trigger this vulnerability by:

1. Creating or manipulating a corrupted ext4 filesystem image
2. Mounting the corrupted filesystem on a target system
3. Performing operations that trigger extended attribute processing on corrupted inodes
4. The kernel will encounter the corruption during ext4_get_inode_loc(), fail to handle the error, and crash when dereferencing the null pointer

This vulnerability could also be triggered inadvertently through natural filesystem corruption events or hardware failures that corrupt filesystem metadata.

The vulnerability mechanism involves the missing error check pattern where ext4_get_inode_loc() returns an error code that is not validated before the subsequent ext4_raw_inode() call attempts to access iloc.bh->b_data. See the kernel commit changes for technical implementation details.

Detection Methods for CVE-2025-68820

Indicators of Compromise

• Kernel panic messages referencing ext4_raw_inode or ext4_xattr_inode_dec_ref_all in stack traces
• System crashes occurring during ext4 filesystem operations involving extended attributes
• Error messages indicating -EFSCORRUPTED immediately before system instability
• Unexpected kernel oops or BUG reports in kernel logs related to ext4 subsystem

Detection Strategies

• Monitor kernel logs for null pointer dereference errors in ext4 xattr code paths
• Implement filesystem integrity checking using e2fsck to detect corruption before mounting
• Deploy kernel crash dump analysis tools to identify exploitation attempts
• Use static analysis tools like SVACE on kernel builds to identify similar patterns

Monitoring Recommendations

• Enable kernel crash dumps for post-mortem analysis of system crashes
• Monitor dmesg and system logs for ext4-related error messages
• Implement proactive filesystem health monitoring for ext4 partitions
• Deploy endpoint detection solutions that can identify kernel-level anomalies

How to Mitigate CVE-2025-68820

Immediate Actions Required

• Apply the latest kernel patches from your Linux distribution that address this vulnerability
• Run filesystem integrity checks (e2fsck) on ext4 filesystems before mounting untrusted images
• Avoid mounting untrusted or potentially corrupted ext4 filesystem images
• Consider temporarily disabling extended attribute support if not required

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix adds proper error checking for the return value of ext4_get_inode_loc() in ext4_xattr_inode_dec_ref_all() to prevent the null pointer dereference.

Multiple patch commits have been applied to stable kernel branches:

• Commit 190ad0f22ba4
• Commit 5b154e901fda
• Commit b5d942922182
• Commit b97cb7d6a051
• Commit ce5f54c065a4

Workarounds

• Restrict mounting of untrusted ext4 filesystem images to isolated environments
• Use filesystem integrity verification tools before mounting external media
• Implement mount options that limit xattr operations on potentially untrusted filesystems
• Consider using alternative filesystems for untrusted media when possible

# Configuration example
# Run filesystem check before mounting untrusted ext4 images
e2fsck -n /dev/sdX1

# Mount with read-only option for initial inspection
mount -o ro,noexec /dev/sdX1 /mnt/untrusted

# Check kernel version for patch status
uname -r