What’s Vulnerable › Vulnerabilities

CVE-2025-40179: ext4: verify orphan file size is not too big

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-12 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus filesystems with absurdly large orphan files can lead to big amounts of memory consumed. Limit orphan file size to a sane value and also use kvmalloc() for allocating array of block descriptor structures to avoid large order allocations for sane but large orphan files.

Affected products

• Linux kernel: 5.15 — fixed in 6.18

How to fix

Upgrade to a fixed version: Linux kernel 6.18. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0a6ce20c156442a4ce2a404747bb0fb05d54eeb3
• https://git.kernel.org/stable/c/2b9da798ff0f4d026c5f0f815047393ebe7d8859
• https://git.kernel.org/stable/c/304fc34ff6fc8261138fd81f119e024ac3a129e9
• https://git.kernel.org/stable/c/566a1d6084563bd07433025aa23bcea4427de107
• https://git.kernel.org/stable/c/95a21611b14ae0a401720645245a8db16f040995
• https://git.kernel.org/stable/c/a2d803fab8a6c6a874277cb80156dc114db91921

Get alerted when CVE-2025-40179 or the next vulnerability affects your stack