CVE-2025-40179: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40179 is a denial-of-service vulnerability in the Linux kernel's ext4 filesystem subsystem caused by insufficient validation of orphan file size. An attacker with local access can craft or mount a filesystem containing an absurdly large orphan file, causing excessive memory consumption during orphan replay. The vulnerability was published on November 12, 2025, and affects Linux kernel versions from commit 02f310fcf47f onward across multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector and no privileges beyond a low-privileged user required (Microsoft MSRC, Feedly).

The root cause is improper input validation (CWE-20) in the ext4 orphan file handling code: the kernel did not enforce an upper bound on orphan file size, and during orphan replay it traverses the entire file while pinning all associated buffers in memory. This can be triggered locally by a user who can mount or influence a crafted ext4 filesystem image. The fix introduces a sanity check limiting orphan file size to a reasonable maximum and switches the block descriptor array allocation to kvmalloc() to avoid high-order memory allocations even for legitimately large orphan files. Patches are referenced in the upstream stable tree across multiple kernel versions (Feedly).

Successful exploitation results in significant memory exhaustion on the affected host, as the kernel pins all orphan file buffers in memory during replay. This can cause severe system performance degradation, memory pressure leading to OOM conditions, and ultimately a denial of service. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The EPSS score is approximately 0.024% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and the ability to mount or present a crafted ext4 filesystem to the kernel (Feedly).

Patches have been released for multiple Linux kernel stable branches: 5.15.195, 6.1.157, 6.6.113, 6.12.54, 6.17.4, and 6.18-rc1. Downstream distributions including Ubuntu (USN-8033-x series, USN-8034-x series) and Amazon Linux 2 (ALAS2KERNEL-5.15-2025-095) have also issued updated packages. The recommended remediation is to update to a patched kernel version. As a workaround, restricting unprivileged users from mounting arbitrary filesystems (e.g., via nosuid/nodev mount policies or disabling user namespace mounts) reduces exposure (Feedly, Ubuntu USN-8033).