CVE-2025-40233: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40233 is a Linux kernel vulnerability in the OCFS2 (Oracle Cluster File System 2) subsystem where the extent map cache can become stale after extent moving or defragmentation operations, potentially triggering a kernel panic via BUG_ON in ocfs2_refcount_cal_cow_clusters(). The vulnerability was published on December 4, 2025, and affects Linux kernel versions prior to the patched stable releases. It carries a CVSS v3.1 base score of 7.1 (High), requiring local access with low privileges (Feedly, Microsoft MSRC).

The root cause is a cache coherency flaw (CWE-672: Operation on a Resource after Expiration or Release) in the OCFS2 filesystem's extent map cache. The vulnerability is triggered through a specific sequence: (1) copy_file_range() creates a reflinked extent with the OCFS2_EXT_REFCOUNTED flag set; (2) ioctl(FITRIM) triggers ocfs2_move_extents(); (3) __ocfs2_move_extents_range() reads and caches the extent with flags 0x2; (4) __ocfs2_move_extent() clears the OCFS2_EXT_REFCOUNTED flag on disk (flags become 0x0); (5) the extent map cache is not invalidated, so subsequent write() operations read stale cached flags (0x2) while the disk holds updated flags (0x0), causing a mismatch that triggers BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)). The fix clears the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range() (Feedly).

A local attacker with low privileges on a system using the OCFS2 filesystem can trigger a kernel panic (denial of service) by performing a sequence of file operations involving copy_file_range() followed by ioctl(FITRIM) and a subsequent write(). The confidentiality impact is rated High (potentially exposing kernel memory state), and availability impact is High due to the kernel panic. Integrity is not directly affected. Systems using OCFS2 in shared-disk cluster environments are at risk, and a kernel panic in such environments could disrupt all cluster nodes sharing the filesystem (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to perform specific file operations on an OCFS2-mounted filesystem, limiting the attack surface significantly (Feedly).

1. Precondition: Obtain local user access on a Linux system with an OCFS2 filesystem mounted and accessible.
2. Create a reflinked extent: Use copy_file_range() on a file residing on the OCFS2 filesystem to create a reflinked extent with the OCFS2_EXT_REFCOUNTED flag (0x2) set on disk and cached in the extent map.
3. Trigger extent movement/defragmentation: Issue ioctl(FITRIM) on the OCFS2 filesystem, which internally calls ocfs2_move_extents() and __ocfs2_move_extents_range(), causing the extent to be moved and the OCFS2_EXT_REFCOUNTED flag to be cleared on disk (flags become 0x0), while the in-memory cache retains the stale value (0x2).
4. Trigger the BUG_ON: Perform a write() operation on the reflinked file. The kernel reads stale cached extent flags (0x2) but the on-disk flags are 0x0, causing a mismatch that triggers BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) in ocfs2_refcount_cal_cow_clusters(), resulting in a kernel panic (Feedly).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg output referencing BUG_ON in ocfs2_refcount_cal_cow_clusters() or __ocfs2_move_extents_range().
• Logs: System crash dumps or kernel oops traces mentioning OCFS2 extent map cache invalidation failures.
• Process: Unusual or repeated invocations of ioctl(FITRIM) on OCFS2-mounted filesystems by low-privileged users, potentially visible via strace or audit logs.
• File System: Unexpected system reboots or cluster node failures on systems using OCFS2 shared-disk filesystems, potentially indicating triggered kernel panics.

Apply the upstream Linux kernel patches that fix this issue by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). Fixed versions include: Linux 5.4.301, 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6, and 6.18. Downstream distributions including Debian (DLA-4404-1), Oracle Linux, and SUSE have issued updated kernel packages. As a workaround where patching is not immediately possible, restrict local user access to systems using OCFS2 filesystems and monitor for unexpected kernel panics or system instability (Feedly, Debian LTS).

The vulnerability was noted in the context of December 2025 Patch Tuesday coverage by Rapid7 and Sophos, though it was not highlighted as a critical priority given its local-only attack vector and lack of active exploitation (Rapid7 Blog, Sophos News). No significant independent researcher commentary or social media discussion specific to this CVE has been observed.