{"id":"CVE-2025-38701","title":"ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: do not BUG when INLINE_DATA_FL lacks system.data xattr\n\nA syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data()\nwhen an inode had the INLINE_DATA_FL…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 8085a7324d8ec448c4a764af7853e19bbd64e17a","Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 1199a6399895f4767f0b9a68a6ff47c3f799b7c7","Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 7f322c12df7aeed1755acd3c6fab48c7807795fb","Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 2817ac83cb4732597bf36853fe13ca616f4ee4e2","Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < d960f4b793912f35e9d72bd9d1e90553063fcbf1","Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c","Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 279c87ef7b9da34f65c2e4db586e730b667a6fb9","Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 8a6f89d42e61788605722dd9faf98797c958a7e5","Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42","Linux 3.8"],"published":"2025-09-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:07:39.600Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38701","references":[{"url":"https://git.kernel.org/stable/c/8085a7324d8ec448c4a764af7853e19bbd64e17a"},{"url":"https://git.kernel.org/stable/c/1199a6399895f4767f0b9a68a6ff47c3f799b7c7"},{"url":"https://git.kernel.org/stable/c/7f322c12df7aeed1755acd3c6fab48c7807795fb"},{"url":"https://git.kernel.org/stable/c/2817ac83cb4732597bf36853fe13ca616f4ee4e2"},{"url":"https://git.kernel.org/stable/c/d960f4b793912f35e9d72bd9d1e90553063fcbf1"},{"url":"https://git.kernel.org/stable/c/81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c"},{"url":"https://git.kernel.org/stable/c/279c87ef7b9da34f65c2e4db586e730b667a6fb9"},{"url":"https://git.kernel.org/stable/c/8a6f89d42e61788605722dd9faf98797c958a7e5"},{"url":"https://git.kernel.org/stable/c/099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42"}],"tags":["cve.org"],"epss":0.00183,"epssPercentile":0.07778,"ingestedAt":"2026-10-15T05:52:46.083Z","slug":"CVE-2025-38701","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\next4: do not BUG when INLINE_DATA_FL lacks system.data xattr\n\nA syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data()\nwhen an inode had the INLINE_DATA_FL flag set but was missing the\nsystem.data extended attribute.\n\nSince this can happen due to a maiciouly fuzzed file system, we\nshouldn't BUG, but rather, report it as a corrupted file system.\n\nAdd similar replacements of BUG_ON with EXT4_ERROR_INODE() ii\next4_create_inline_data() and ext4_inline_data_truncate().\n\n## Affected\n\n- `Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 8085a7324d8ec448c4a764af7853e19bbd64e17a`\n- `Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 1199a6399895f4767f0b9a68a6ff47c3f799b7c7`\n- `Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 7f322c12df7aeed1755acd3c6fab48c7807795fb`\n- `Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 2817ac83cb4732597bf36853fe13ca616f4ee4e2`\n- `Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < d960f4b793912f35e9d72bd9d1e90553063fcbf1`\n- `Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c`\n- `Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 279c87ef7b9da34f65c2e4db586e730b667a6fb9`\n- `Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 8a6f89d42e61788605722dd9faf98797c958a7e5`\n- `Linux >= 67cf5b09a46f72e048501b84996f2f77bc42e947 < 099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42`\n- `Linux 3.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}