5.5

CVE-2025-22120: linux

CVSS: 5.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-22120DEBIAN-CVE-2025-22120
Published 16-04-2025Last modified 23-05-2026
Open JSON

Vulnerability summary

CVE-2025-22120 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.19%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 30 · Related 30
SUSE-SU-2025:02249-1SUSE-SU-2025:02254-1SUSE-SU-2025:02307-1SUSE-SU-2025:02333-1SUSE-SU-2025:02335-1SUSE-SU-2025:02538-1

Timeline

  1. 16-04-2025
    PublishedVulnerability first disclosed.
  2. 23-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: goto right label 'out_mmap_sem' in ext4_setattr() Otherwise, if ext4_inode_attach_jinode() fails, a hung task will happen because filemap_invalidate_unlock() isn't called to unlock mapping->invalidate_lock. Like this: EXT4-fs error (device sda) in ext4_setattr:5557: Out of memory INFO: task fsstress:374 blocked for more than 122 seconds. Not tainted 6.14.0-rc1-next-20250206-xfstests-dirty #726 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:fsstress state:D stack:0 pid:374 tgid:374 ppid:373 task_flags:0x440140 flags:0x00000000 Call Trace: <TASK> __schedule+0x2c9/0x7f0 schedule+0x27/0xa0 schedule_preempt_disabled+0x15/0x30 rwsem_down_read_slowpath+0x278/0x4c0 down_read+0x59/0xb0 page_cache_ra_unbounded+0x65/0x1b0 filemap_get_pages+0x124/0x3e0 filemap_read+0x114/0x3d0 vfs_read+0x297/0x360 ksys_read+0x6c/0xe0 do_syscall_64+0x4b/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

8%

Versus all other CVEs

30-day change

0.00 pp

From 0.19% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.19%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu112 products
  • linux< 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 93011887013dbaa0e3a0285176ca89be153df651, < 551667f99bcf04fa58594d7d19aef73c861a1200 | ≥ b6ce2dbe984bcd7fb0c1df15b5e2fa57e1574a8e, < 45314999f950321a341033ae8f9ac12dce40669b | ≥ c7fc0366c65628fd69bfc310affec4918199aae2, < 32d872e3905746ff1048078256cb00f946b97d8a | ≥ c7fc0366c65628fd69bfc310affec4918199aae2, < 7e91ae31e2d264155dfd102101afc2de7bd74a64 | ≥ 6.6.70, < 6.6.89 | ≥ 6.12.5, < 6.12.26 | 6.13
  • linux_kernel≥ 6.6.70, < 6.6.89 | ≥ 6.12.5, < 6.12.26 | ≥ 6.13, < 6.14.2
Debian1 product
  • linux< 6.12.27-1

3 vendors · 115 products

References

27 links
Show all 27 references