{"cve":"CVE-2025-22120","nvd":{"published":"2025-04-16T15:16:06.190","modified":"2026-06-17T08:45:11.543","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: goto right label 'out_mmap_sem' in ext4_setattr()\n\nOtherwise, if ext4_inode_attach_jinode() fails, a hung task will\nhappen because filemap_invalidate_unlock() isn't called to unlock\nmapping->invalidate_lock. Like this:\n\nEXT4-fs error (device sda) in ext4_setattr:5557: Out of memory\nINFO: task fsstress:374 blocked for more than 122 seconds.\n      Not tainted 6.14.0-rc1-next-20250206-xfstests-dirty #726\n\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\ntask:fsstress state:D stack:0     pid:374   tgid:374   ppid:373\n                                  task_flags:0x440140 flags:0x00000000\nCall Trace:\n <TASK>\n __schedule+0x2c9/0x7f0\n schedule+0x27/0xa0\n schedule_preempt_disabled+0x15/0x30\n rwsem_down_read_slowpath+0x278/0x4c0\n down_read+0x59/0xb0\n page_cache_ra_unbounded+0x65/0x1b0\n filemap_get_pages+0x124/0x3e0\n filemap_read+0x114/0x3d0\n vfs_read+0x297/0x360\n ksys_read+0x6c/0xe0\n do_syscall_64+0x4b/0x110\n entry_SYSCALL_64_after_hwframe+0x76/0x7e","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/32d872e3905746ff1048078256cb00f946b97d8a","https://git.kernel.org/stable/c/45314999f950321a341033ae8f9ac12dce40669b","https://git.kernel.org/stable/c/551667f99bcf04fa58594d7d19aef73c861a1200","https://git.kernel.org/stable/c/7e91ae31e2d264155dfd102101afc2de7bd74a64"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:01:11.054312287+00:00"},"epss":{"cve":"CVE-2025-22120","score":0.00189,"percentile":0.08557,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}