CVE-2025-23150: ext4: fix off-by-one error in do_split
Noroxi assessment
Priority: Monitor (action score 22/100)
- The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
- Probability of exploitation in the next 30 days: 0.23% (FIRST EPSS).
- Someone with local access to the system can trigger it. A low-privileged account is enough. No user action is required. No special conditions are required; it is repeatable.
- Fixed version: Linux Linux 16d9067f00e3a7d1df7c3aa9c20d214923d27e10, 17df39f455f1289319d4d09e4826aa46852ffd17, 2883e9e74f73f9265e5f8d1aaaa89034b308e433; azl3 kernel 6.6.85.1-4 on Azure Linux 3.0 6.6.92.2-1; azl3 kernel 6.6.92.2-1 on Azure Linux 3.0 6.6.92.2-1.
- Severity is disputed: the assigning authority (CNA) scores it 7.8, NVD 5.5.
Low priority for now. Upgrade to Linux Linux 16d9067f00e3a7d1df7c3aa9c20d214923d27e10, 17df39f455f1289319d4d09e4826aa46852ffd17, 2883e9e74f73f9265e5f8d1aaaa89034b308e433; azl3 kernel 6.6.85.1-4 on Azure Linux 3.0 6.6.92.2-1; azl3 kernel 6.6.92.2-1 on Azure Linux 3.0 6.6.92.2-1 or later.
Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it
Primary sources: NVD · CVE.org · FIRST EPSS
In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847 CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> The following loop is located right above 'if' statement. for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; } 'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
- BDU:2025-12110
- ALSA-2025:11298
- ALSA-2025:11299
- ALSA-2025:9302
- RHSA-2025:11245
- RHSA-2025:11298
- RHSA-2025:11299
- RHSA-2025:11571
- RHSA-2025:11572
- RHSA-2025:12525
- RHSA-2025:12526
- RHSA-2025:13061
- RHSA-2025:13776
- RHSA-2025:13805
- RHSA-2025:14746
- RHSA-2025:14748
- RHSA-2025:9302
- RHSA-2025:9348
- RLSA-2025:11298
- RLSA-2025:11299
- Published
- May 1, 2025
- Updated
- Aug 5, 2026
- EPSS
- 0.2% · 14th percentile
- CWE
- CWE-193
Report tools
Action score
22
Monitor
Low priority for now.
- CVSS
- 22 / 40 · 5.5 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.2%
CISA SSVC decision
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
Vulnrichment: CISA's decision-tree inputs.
CNA vs NVD score
- NVD
- 5.5
- CNA · Linux
- 7.8
- 2.3 point gap
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.
Get told when this record changes
- Not in KEV: no record of exploitation in the wild
- No public exploit code on record
- A fix has been released
If any of these changes, we'll tell you in the daily email digest.
Running WordPress? Scan your site free with WP Lens
Noroxi analysis
What does it mean in your environment?
The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.
We use this product, ask for helpAffected systems
Is your version affected?
Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.
| Vendor | Product | CPE |
|---|---|---|
| linux | linux kernel | cpe:2.3:o:linux:linux_kernel |
| debian | debian linux | cpe:2.3:o:debian:debian_linux |
Affected versions
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- debian debian linux11.0
- linux linux kernel4.9.234 and later · before 4.10
- linux linux kernel4.14.195 and later · before 4.15
- linux linux kernel4.19.142 and later · before 4.20
- linux linux kernel5.4.61 and later · before 5.4.293
- linux linux kernel5.7.18 and later · before 5.8
- linux linux kernel5.8.4 and later · before 5.9
- linux linux kernel5.9.1 and later · before 5.10.237
- linux linux kernel4.4.234 and later · before 4.5
- linux linux kernel5.16 and later · before 6.1.135
- linux linux kernel6.2 and later · before 6.6.88
- linux linux kernel6.7 and later · before 6.12.24
- linux linux kernel6.13 and later · before 6.13.12
- linux linux kernel6.14 and later · before 6.14.3
- linux linux kernel5.11 and later · before 5.15.181
- linux linux kernel5.9
- linux linux kernel6.15
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 059b1480105478c5f68cf664301545b8cad6a7cf, 539ae3e03875dacaa9c388aff141ccbb4ef4ecb5, fbbfd55a40d5d0806b59ee0403c75d5ac517533f, b3ddf6ba5e28a57729fff1605ae08e21be5c92e3, e50fe43e3062e18846e99d9646b9c07b097eb1ed, 88e79f7a9841278fa8ff7ff6178bad12da002ffc, 5.9affected
- ea54176e5821936d109bb45dc2c19bd53559e735 and later · before b96bd2c3db26ad0daec5b78c85c098b53900e2e1affected · git
- 5872331b3d91820e14716632ebb56b1399b34fe1 and later · before 515c34cff899eb5dae6aa7eee01c1295b07d81afaffected · git
- 5872331b3d91820e14716632ebb56b1399b34fe1 and later · before 2883e9e74f73f9265e5f8d1aaaa89034b308e433affected · git
- 5872331b3d91820e14716632ebb56b1399b34fe1 and later · before 35d0aa6db9d93307085871ceab8a729594a98162affected · git
- 5872331b3d91820e14716632ebb56b1399b34fe1 and later · before 2eeb1085bf7bd5c7ba796ca4119925fa5d336a3faffected · git
- 5872331b3d91820e14716632ebb56b1399b34fe1 and later · before 16d9067f00e3a7d1df7c3aa9c20d214923d27e10affected · git
- 5872331b3d91820e14716632ebb56b1399b34fe1 and later · before 17df39f455f1289319d4d09e4826aa46852ffd17affected · git
- 5872331b3d91820e14716632ebb56b1399b34fe1 and later · before ab0cc5c25552ae0d20eae94b40a93be11b080fc5affected · git
- 5872331b3d91820e14716632ebb56b1399b34fe1 and later · before 94824ac9a8aaf2fb3c54b4bdde842db80ffa555daffected · git
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| AlmaLinux:8 | bpftool | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-abi-stablelists | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-core | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-cross-headers | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-debug | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-debug-core | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-debug-devel | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules-extra | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-devel | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-doc | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-headers | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-modules | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-modules-extra | before 4.18.0-553.62.1.el8_10 | 4.18.0-553.62.1.el8_10 |
| AlmaLinux:8 | kernel-rt | before 4.18.0-553.62.1.rt7.403.el8_10 | 4.18.0-553.62.1.rt7.403.el8_10 |
| AlmaLinux:8 | kernel-rt-core | before 4.18.0-553.62.1.rt7.403.el8_10 | 4.18.0-553.62.1.rt7.403.el8_10 |
| AlmaLinux:8 | kernel-rt-debug | before 4.18.0-553.62.1.rt7.403.el8_10 | 4.18.0-553.62.1.rt7.403.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-core | before 4.18.0-553.62.1.rt7.403.el8_10 | 4.18.0-553.62.1.rt7.403.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-devel | before 4.18.0-553.62.1.rt7.403.el8_10 | 4.18.0-553.62.1.rt7.403.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules | before 4.18.0-553.62.1.rt7.403.el8_10 | 4.18.0-553.62.1.rt7.403.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | before 4.18.0-553.62.1.rt7.403.el8_10 | 4.18.0-553.62.1.rt7.403.el8_10 |
| AlmaLinux:8 | kernel-rt-devel | before 4.18.0-553.62.1.rt7.403.el8_10 | 4.18.0-553.62.1.rt7.403.el8_10 |
| AlmaLinux:8 | kernel-rt-modules | before 4.18.0-553.62.1.rt7.403.el8_10 | 4.18.0-553.62.1.rt7.403.el8_10 |
+96
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV90Now
- CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV89Now
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV85Now
Published before and after this one in the same product
- ← EarlierCVE-2025-23146May 1, 2025 · mfd: ene-kb3930: Fix a potential NULL pointer dereference22Monitor
- ← EarlierCVE-2025-23148May 1, 2025 · soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()22Monitor
- Later →CVE-2025-23152May 1, 2025 · arm64/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch()22Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 16d9067f00e3a7d1df7c3aa9c20d214923d27e10 | Vendor (CNA) |
| Linux Linux | 17df39f455f1289319d4d09e4826aa46852ffd17 | Vendor (CNA) |
| Linux Linux | 2883e9e74f73f9265e5f8d1aaaa89034b308e433 | Vendor (CNA) |
| Linux Linux | 2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f | Vendor (CNA) |
| Linux Linux | 35d0aa6db9d93307085871ceab8a729594a98162 | Vendor (CNA) |
| Linux Linux | 4.10 | Vendor (CNA) |
| Linux Linux | 4.15 | Vendor (CNA) |
| Linux Linux | 4.20 | Vendor (CNA) |
| Linux Linux | 4.5 | Vendor (CNA) |
| Linux Linux | 5.4.293 | Vendor (CNA) |
| Linux Linux | 5.8 | Vendor (CNA) |
| Linux Linux | 5.9 | Vendor (CNA) |
| Linux Linux | 515c34cff899eb5dae6aa7eee01c1295b07d81af | Vendor (CNA) |
| Linux Linux | 94824ac9a8aaf2fb3c54b4bdde842db80ffa555d | Vendor (CNA) |
| Linux Linux | ab0cc5c25552ae0d20eae94b40a93be11b080fc5 | Vendor (CNA) |
| Linux Linux | b96bd2c3db26ad0daec5b78c85c098b53900e2e1 | Vendor (CNA) |
| azl3 kernel 6.6.85.1-4 on Azure Linux 3.0 | 6.6.92.2-1 · CBL-Mariner Releases | Microsoft (MSRC) |
| azl3 kernel 6.6.92.2-1 on Azure Linux 3.0 | 6.6.92.2-1 · CBL-Mariner Releases | Microsoft (MSRC) |
| almalinux:bpftool | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-abi-stablelists | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-core | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-cross-headers | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-debug | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-debug-core | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-debug-devel | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-debug-modules | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-debug-modules-extra | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-devel | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:kernel-doc | 4.18.0-553.62.1.el8_10 · AlmaLinux:8 | Package registry (OSV) |
+15
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
No history yet (it accumulates with the daily EPSS job).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
No commit or PR link among the references.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
No credits in the CNA record.
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
- CVE-2026-53088419 days apartnet: bcmgenet: fix off-by-one in bcmgenet_put_txcb39Monitor
- CVE-2026-53309421 days apartocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison39Monitor
- CVE-2026-64047444 days apartnet: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring39Monitor
- CVE-2024-5799064 days apartwifi: mt76: mt7925: fix off by one in mt7925_load_clc()31Monitor
- CVE-2024-47682192 days apartscsi: sd: Fix off-by-one error in sd_read_block_characteristics()31Monitor
- CVE-2024-49880192 days apartext4: fix off by one issue in alloc_flex_gd()31Monitor
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
No known public program.
Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).
Technical details
Attack conditions
- Someone with local access to the system can trigger it.
- A low-privileged account is enough.
- No user action is required.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- none
- Integrity
- none
- Availability
- high · the service can be disrupted
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- None
- Integrity impact
- None
- Availability impact
- High
Weakness class (CWE)
CWE-193 · Off-by-one ErrorCVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd-primary
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
MITRE has no CAPEC/ATT&CK mapping for this CWE.
Change log
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
Show all references (10 more)Show less
- git.kernel.org/stable/c/17df39f455f1289319d4d09e4826aa46852ffd17
- git.kernel.org/stable/c/2883e9e74f73f9265e5f8d1aaaa89034b308e433
- git.kernel.org/stable/c/2eeb1085bf7bd5c7ba796ca4119925fa5d336a3f
- git.kernel.org/stable/c/35d0aa6db9d93307085871ceab8a729594a98162
- git.kernel.org/stable/c/515c34cff899eb5dae6aa7eee01c1295b07d81af
- git.kernel.org/stable/c/94824ac9a8aaf2fb3c54b4bdde842db80ffa555d
- git.kernel.org/stable/c/ab0cc5c25552ae0d20eae94b40a93be11b080fc5
- git.kernel.org/stable/c/b96bd2c3db26ad0daec5b78c85c098b53900e2e1
- lists.debian.org/debian-lts-announce/2025/05/msg00030.html
- lists.debian.org/debian-lts-announce/2025/05/msg00045.html
Vendor advisories and official records. Exploit/PoC links are deliberately left out.