CVE-2025-68261

A flaw was discovered in the Linux kernel’s EXT4 filesystem implementation involving a race between inline data destruction and block mapping. In the function ext4_destroy_inline_data_nolock(), the inode layout is modified (clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS) without holding the i_data_sem semaphore. Concurrently, another thread may execute ext4_map_blocks(), which tests the EXT4_INODE_EXTENTS flag to decide whether to call ext4_ext_map_blocks() or ext4_ind_map_blocks(). Without proper semaphore protection, ext4_ind_map_blocks() can be invoked with an inconsistent state, potentially triggering a kernel assertion and crash (BUG).

A moderate denial-of-service vulnerability was found in the Linux kernel ext4 filesystem code as shipped in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS 1. ext4_destroy_inline_data_nolock() changes an inode's data layout (clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS) without holding the i_data_sem semaphore. If another thread concurrently executes ext4_map_blocks(), it may test the EXT4_INODE_EXTENTS flag against this inconsistent state and call ext4_ind_map_blocks() on an extents-mapped inode, triggering a kernel assertion (BUG) and crashing the system. Exploiting this race requires local access with the ability to run code performing concurrent file operations on an ext4 filesystem that uses inline data, and the impact is limited to system availability; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVE record's Important rating (CVSS 7.5, AV:N) because the upstream network attack vector does not apply here: the race can only be triggered locally by a user with local privileges on the system. Because this issue is a local denial of service with limited security impact, the fix is currently deferred on the affected streams; the residual risk is that a local user who wins the race could panic the kernel and disrupt system availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.