# CVE-2025-68264: ext4: refresh inline data size before write operations

> A race condition in the Linux kernel ext4 filesystem allows local attackers to trigger a kernel crash via concurrent inline data and xattr operations.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 16 Dec 2025
- **Updated:** 15 Oct 2026
- **Also known as:** AZL-72455, BELL-CVE-2025-68264, DEBIAN-CVE-2025-68264, GHSA-wp53-jh6w-3pf7, ROOT-OS-DEBIAN-11-CVE-2025-68264, ROOT-OS-DEBIAN-12-CVE-2025-68264, ROOT-OS-UBUNTU-2204-CVE-2025-68264, ROOT-OS-UBUNTU-2404-CVE-2025-68264, UBUNTU-CVE-2025-68264

## What is CVE-2025-68264?

CVE-2025-68264 is a vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ext4: refresh inline data size before write operations

The cached ei->i_inline_size can become stale between the initial size
check and when ext4_update_inline_data()/ext4_create_inline_data() use
it. Although ext4_get_max_inline_size() reads the correct value at the
time of the check, concurrent xattr operations can modify i_inline_size
before ext4_write_lock_xattr() is acquired.

This causes ext4_update_inline_data() and ext4_create_inline_data() to
work with stale capacity values, leading to a BUG_ON() crash in
ext4_write_inline_data():

  kernel BUG at fs/ext4/inline.c:1331!
  BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);

The race window:
1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)
2. Size check passes for 50-byte write
3. [Another thread adds xattr, i_inline_size changes to 40]
4. ext4_write_lock_xattr() acquires lock
5. ext4_update_inline_data() uses stale i_inline_size = 60
6. Attempts to write 50 bytes but only 40 bytes actually available
7. BUG_ON() triggers

Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock()
immediately after acquiring xattr_sem. This ensures ext4_update_inline_data()
and ext4_create_inline_data() work with current values that are protected
from concurrent modifications.

This is similar to commit a54c4613dac1 ("ext4: fix race writing to an
inline_data file while its xattrs are changing") which fixed i_inline_off
staleness. This patch addresses the related i_inline_size staleness issue.

## Which versions are affected by CVE-2025-68264?


## How do I fix CVE-2025-68264?

Apply the vendor's patch.

## Is CVE-2025-68264 being exploited?

There is no known exploitation of CVE-2025-68264 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-68264 and fix it if it is affected.

What it is: CVE-2025-68264 is a vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-68264 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-68264/ (Markdown: https://insights.sbomify.com/CVE-2025-68264/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-68264
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-68264
- OSV: https://osv.dev/vulnerability/CVE-2025-68264

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-68264/
Summaries are generated and may contain mistakes; the official description above is the record.