Linux Kernel CVE-2025-40190

In the Linux kernel, the following vulnerability has been resolved:

ext4: guard against EA inode refcount underflow in xattr update

syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like:

EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117

Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode().

This prevents the underflow and the follow-on orphan/cleanup churn.

The Linux kernel's ext4 filesystem driver is affected across multiple stable branches, as evidenced by the eight stable-tree fix commits referenced (git.kernel.org/stable/c/1cfb3e4ddbdc..., 3d6269028246..., 440b003f449a..., 505e69f76ac4..., 57295e835408..., 6b879c4c6bba..., 79ea7f3e11ef..., and ea39e712c2f5...). Precise vulnerable version ranges are not enumerated in the provided data and no CPE strings were supplied, so exact kernel version boundaries should be confirmed against each stable branch's fix commit and the corresponding kernel.org release notes; any kernel using ext4 with EA-inode (large/many xattr) support prior to these backports should be considered potentially affected.