The Linux kernel ext4 filesystem had a vulnerability (CVE-2025-40167) where an inode could incorrectly have both INLINE_DATA and EXTENTS flags set. This invalid combination caused ext4_has_inline_data() to return true, which skipped extent tree validation in __ext4_iget(). Consequently, unvalidated out-of-order extents triggered a BUG_ON in ext4_es_cache_extent() due to integer underflow when calculating hole sizes. The flaw was detected by syzbot when opening a verity file on a corrupted ext4 filesystem mounted without a journal. The vulnerability is resolved by adding early detection of this invalid flag combination in ext4_iget() and rejecting the corrupted inode.

This vulnerability can cause a kernel crash (BUG_ON) due to integer underflow when handling corrupted ext4 inodes with invalid flag combinations. The impact includes potential denial of service and possible compromise of system stability. The CVSS vector indicates local attack vector with low complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality, integrity, and availability impacts.

A fix is available that detects and rejects inodes with the invalid INLINE_DATA and EXTENTS flag combination early in ext4_iget(). Users should apply the official Linux kernel updates that address this issue. Since no explicit patch links are provided here, consult the Linux kernel vendor advisories or mainline kernel updates for the fix. No additional mitigations are indicated by the vendor advisory.