Critical Vulnerability in Linux Kernel: ext4 File System Error Handling
Summary
DEBIAN-CVE-2025-22120: In the Linux kernel, the following vulnerability has been resolved: ext4: goto right label 'out_mmap_sem' in ext4_setattr() Otherwise, if ext4_inode_attach_jinode() fails, a hung task will happen because filemap_invalida... Affects linux versions < 6.12.27-1. Fixed in 6.12.27-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports various file systems, including ext4, which is widely used for its performance and reliability. However, a vulnerability has been identified in the ext4 file system that can lead to system hangs under specific conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been discovered in the ext4 file system related to improper error handling in the ext4_setattr() function. If ext4_inode_attach_jinode() fails, the system may experience a hung task because filemap_invalidate_unlock() is not called to release the mapping->invalidate_lock. This can lead to significant delays, as tasks may be blocked for extended periods, causing system instability and potential data loss.
How To Fix
Minimum fixed version
6.12.27-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the hung task timeout message by executing the following command: echo 0 > /proc/sys/kernel/hung_task_timeout_secs. However, this does not fix the underlying issue and should only be used as a short-term measure.
Conclusion
The identified vulnerability in the Linux kernel's ext4 file system poses a significant risk to system stability. Users are strongly encouraged to update their Linux packages to the patched version to safeguard against potential issues. For ongoing monitoring of vulnerabilities, tools like Vulert can provide real-time alerts.
See every vulnerability recorded for linux →
FAQ
The vulnerability can cause tasks to hang for extended periods, leading to system instability and potential data loss.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability affects Debian versions 13 and 14 of the Linux package prior to version 6.12.27-1.
Yes, updating the Linux package to version 6.12.27-1 or later will permanently fix the vulnerability.
If an immediate update is not possible, consider applying the temporary workaround to mitigate the effects of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
