CVE-2025-40167

A flaw was found in the Linux kernel’s ext4 filesystem: during inode initialization (__ext4_iget()), the code did not properly validate a corrupted inode that has both INLINE_DATA and EXTENTS flags set simultaneously. This invalid flag combination may cause ext4_has_inline_data() to return true, skipping validation of the extent tree, which in turn can lead to integer underflow in ext4_es_cache_extent(), triggering a kernel BUG_ON

This issue is triggered by a specially crafted disk image containing on-disk metadata inconsistencies. Exploitation requires that an attacker convince a user to download and use a malicious image from an untrusted source, a scenario with limited practical impact. Red Hat rates this as Low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.