CVE-2025-38701
📋 TL;DR
A Linux kernel vulnerability in the ext4 filesystem where a maliciously crafted filesystem image triggers a kernel panic (BUG_ON) when an inode has the INLINE_DATA_FL flag set but lacks the required system.data extended attribute. This affects systems using ext4 filesystems and can be exploited by mounting a malicious filesystem image. The vulnerability leads to denial of service through kernel panic.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.
Likely Case
Local denial of service through kernel panic when mounting a malicious filesystem image.
If Mitigated
System continues operation with filesystem corruption reported via EXT4_ERROR_INODE instead of crashing.
🎯 Exploit Status
Requires creating and mounting a specially crafted ext4 filesystem image
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel stable releases containing commits 099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42 and related
Vendor Advisory: https://git.kernel.org/stable/c/099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from distribution vendor. 2. Reboot system to load new kernel.
🔧 Temporary Workarounds
Restrict filesystem mounting
allLimit ability to mount filesystems to trusted users only
chmod 700 /bin/mount
setfacl -m u:trusted_user:rwx /bin/mount
🧯 If You Can't Patch
- Implement strict access controls on mount command and filesystem image handling
- Monitor for unexpected kernel panics and investigate mount operations
🔍 How to Verify
Check if Vulnerable:
Check kernel version and verify if patches are applied: grep -q '099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42' /proc/kallsyms || echo 'Possibly vulnerable'Check Version:
uname -rVerify Fix Applied:
Verify kernel contains the fix: uname -r and check with distribution vendor for patched kernel version📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/log/messages or dmesg
- EXT4-fs error messages indicating corrupted filesystem
Network Indicators:
- None - local exploitation only
SIEM Query:
source="kernel" AND ("BUG:" OR "kernel panic" OR "EXT4-fs error")🔗 References
- https://git.kernel.org/stable/c/099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42
- https://git.kernel.org/stable/c/1199a6399895f4767f0b9a68a6ff47c3f799b7c7
- https://git.kernel.org/stable/c/279c87ef7b9da34f65c2e4db586e730b667a6fb9
- https://git.kernel.org/stable/c/2817ac83cb4732597bf36853fe13ca616f4ee4e2
- https://git.kernel.org/stable/c/7f322c12df7aeed1755acd3c6fab48c7807795fb
- https://git.kernel.org/stable/c/8085a7324d8ec448c4a764af7853e19bbd64e17a
- https://git.kernel.org/stable/c/81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c
- https://git.kernel.org/stable/c/8a6f89d42e61788605722dd9faf98797c958a7e5
- https://git.kernel.org/stable/c/d960f4b793912f35e9d72bd9d1e90553063fcbf1
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
