CVE-2025-40233

CVE-2025-40233

High · published December 4, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
4.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or

defragmented, causing subsequent operations to see outdated extent flags.

This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED

2. ioctl(FITRIM) triggers ocfs2_move_extents()

3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2)

4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent()

which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)

5. The extent map cache is not invalidated after the move

6. Later write() operations read stale cached flags (0x2) but disk has

updated flags (0x0), causing a mismatch

7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag

operation in __ocfs2_move_extents_range(). This ensures subsequent

operations read fresh extent data from disk.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00155 · 4.3th percentile
Published
2025-12-04T21:16Z
References (8)
EPSS history
Timeline
  • 04 DEC 15:31Z
    ocfs2: clear extent cache after moving/defragmenting extents
    cvelistv5