CVE-2025-40179
ext4: verify orphan file size is not too big
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
12 Nov 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In the Linux kernel, the following vulnerability has been resolved:
ext4: verify orphan file size is not too big
In principle orphan file can be arbitrarily large. However orphan replay
needs to traverse it all and we also pin all its buffers in memory. Thus
filesystems with absurdly large orphan files can lead to big amounts of
memory consumed. Limit orphan file size to a sane value and also use
kvmalloc() for allocating array of block descriptor structures to avoid
large order allocations for sane but large orphan files.
Affected products
Linux · LinuxReferences
https://git.kernel.org/stable/c/0a6ce20c156442a4ce2a404747bb0fb05d54eeb3https://git.kernel.org/stable/c/2b9da798ff0f4d026c5f0f815047393ebe7d8859https://git.kernel.org/stable/c/304fc34ff6fc8261138fd81f119e024ac3a129e9https://git.kernel.org/stable/c/566a1d6084563bd07433025aa23bcea4427de107https://git.kernel.org/stable/c/95a21611b14ae0a401720645245a8db16f040995https://git.kernel.org/stable/c/a2d803fab8a6c6a874277cb80156dc114db91921