CVE-2025-40190

A flaw was found in the ext4 filesystem implementation in the Linux kernel. The function ext4_xattr_inode_update_ref() may read an EA-inode reference count that is already non-positive and then apply a negative change (-1), causing the reference count to underflow and the filesystem to treat the inode as corrupted. This may lead to unexpected filesystem errors or denial of service (e.g., the filesystem remounting read-only).

This vulnerability is evaluated as having a Moderate severity on Red Hat Enterprise Linux because exploitation is restricted to local access and requires either existing filesystem corruption or the ability to mount a specially prepared ext4 image, limiting the impact to a local denial of service rather than code execution. Standard enterprise deployments typically restrict disk mounting privileges to administrators, preventing untrusted local users from attaching crafted filesystem images. When triggered, the issue results in filesystem errors that may force the partition into read-only mode or cause kernel warnings, affecting system availability without compromising data integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.