CVE-2025-68820

ext4: xattr: fix null pointer deref in ext4_raw_inode()

N/A

Published: January 13, 2026 at 03:29 PM UTC

Updated: October 19, 2026 at 07:17 PM UTC

4 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 CPU 1518-4 Pn /dp MFP FirmwareSiplus S7-1500 CPU 1518-4 Pn /dp MFP Firmware

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fix null pointer deref in ext4_raw_inode() If ext4_get_inode_loc() fails (e.g. if it returns -EFSCORRUPTED), iloc.bh will remain set to NULL. Since ext4_xattr_inode_dec_ref_all() lacks error checking, this will lead to a null pointer dereference in ext4_raw_inode(), called right after ext4_get_inode_loc(). Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

90%

362a90cecd36e8a5c415966d0b75b04a0270e4dd3bc6317033f365ce578eb6039445fb66162722fd5.10.237 5.15.181 5.4.293 6.1.135 6.12.24 6.13.12 6.14.3 6.15 6.6.886aff941cb0f7d0c897c3698ad2e30672709135e376c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3836e625b03a666cf93ff5be328c8cb30336db872c8e008b60492cf6fd31ef127aea6d02fd3d314cdcf9291a3449b04688b81e32621e88de8f4314b54eb59cc31b6ea076021d14b04e7faab1636b87d0ef737418b6de31c962c7192777ee4018906975383

Vendor states this is fixed in 190ad0f22ba49f1101182b80e3af50ca2ddfe72f (fixed)

Vendor states this is fixed in 3d8d22e75f7edfa0b30ff27330fd6a1285d594c3 (fixed)

Vendor states this is fixed in 5b154e901fda2e98570b8f426a481f5740097dc2 (fixed)

Vendor states this is fixed in b5d942922182e82724b7152cb998f540132885ec (fixed)

Vendor states this is fixed in b72a3476f0c97d02f63a6e9fff127348d55436f6 (fixed)

Vendor states this is fixed in b97cb7d6a051aa6ebd57906df0e26e9e36c26d14 (fixed)

Vendor states this is fixed in ce5f54c065a4a7cbb92787f4f140917112350142 (fixed)

Vendor states this is fixed in 5.10.248 (unaffected)

Vendor states this is fixed in 5.15.198 (unaffected)

Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 6.1.160 (unaffected)

Vendor states this is fixed in 6.12.64 (unaffected)