Medium 5.5Published Sep 4, 2025

CVE-2025-38701ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr

Updated under an hour ago (Oct 26, 2026, 2:23 PM ET)

Does this affect you?

It affects Linux and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate().

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 67cf5b09a46f72e048501b84996f2f77bc42e947 before 8085a7324d8ec448c4a764af7853e19bbd64e17a; from 67cf5b09a46f72e048501b84996f2f77bc42e947 before 1199a6399895f4767f0b9a68a6ff47c3f799b7c7; 67cf5b09a46f72e048501b84996f2f77bc42e947 builds before 7f322c12df7aeed1755acd3c6fab48c7807795fb; from 67cf5b09a46f72e048501b84996f2f77bc42e947 before 2817ac83cb4732597bf36853fe13ca616f4ee4e2; from 67cf5b09a46f72e048501b84996f2f77bc42e947 before d960f4b793912f35e9d72bd9d1e90553063fcbf1; from 67cf5b09a46f72e048501b84996f2f77bc42e947 before 81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c; from 67cf5b09a46f72e048501b84996f2f77bc42e947 before 279c87ef7b9da34f65c2e4db586e730b667a6fb9; 67cf5b09a46f72e048501b84996f2f77bc42e947 builds before 8a6f89d42e61788605722dd9faf98797c958a7e5; and 1 more ranges	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.8 before 5.4.297; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/8085a7324d8ec448c4a764af7853e19bbd64e17a	patch
https://git.kernel.org/stable/c/1199a6399895f4767f0b9a68a6ff47c3f799b7c7	patch
https://git.kernel.org/stable/c/7f322c12df7aeed1755acd3c6fab48c7807795fb	patch
https://git.kernel.org/stable/c/2817ac83cb4732597bf36853fe13ca616f4ee4e2	patch
https://git.kernel.org/stable/c/d960f4b793912f35e9d72bd9d1e90553063fcbf1	patch
https://git.kernel.org/stable/c/81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c	patch
https://git.kernel.org/stable/c/279c87ef7b9da34f65c2e4db586e730b667a6fb9	patch
https://git.kernel.org/stable/c/8a6f89d42e61788605722dd9faf98797c958a7e5	patch
https://git.kernel.org/stable/c/099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	mailing-list, third-party-advisory
1–10 of 13

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.