In the Linux kernel, the following vulnerability has been resolved:
ext4: guard against EA inode refcount underflow in xattr update
syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like:
EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117
Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode().
This prevents the underflow and the follow-on orphan/cleanup churn.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.247-246.989Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.195-136.216 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade bpftool6.12-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade perf-debuginfoUpgrade kernel6.12-develUpgrade kernel-modules-extra-commonUpgrade perfUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12Upgrade bpftoolUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel-livepatch-6.1.158-178.288Upgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel6.12-libbpf-staticUpgrade kernelUpgrade kernel-debuginfoUpgrade kernel6.12-tools-develUpgrade python3-perfUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-tools-debuginfoUpgrade kernel-libbpf-develUpgrade kernel6.12-toolsUpgrade kernel-tools-debuginfoUpgrade python3-perf6.12Upgrade kernel6.12-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-modules-extraUpgrade kernel6.12-libbpfUpgrade perf6.12Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel-libbpfUpgrade kernel-headersUpgrade bpftool6.12Upgrade kernel-modules-extraUpgrade kernel6.12-headersUpgrade kernel-livepatch-6.12.55-74.119 | Dec 9, 2025 | Nov 12, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Nov 14, 2025 | Nov 14, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perf | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernelUpgrade kernel-toolsUpgrade python3-perf | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Dec 15, 2025 | Nov 12, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Nov 12, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Nov 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub