CVE-2025-40246
BaseFortify
Publication date: 2025-12-04
Last updated on: 2025-12-04
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds memory read error in the Linux kernel's XFS filesystem code, specifically in the symlink repair functionality. The issue arises because the code incorrectly calculates buffer sizes when handling symbolic links, leading to reading beyond the allocated memory buffer. This happens due to improper use of the min() function parameter related to the size of the data buffer, causing the system to access memory outside the intended bounds.
How can this vulnerability impact me? :
The out-of-bounds read can potentially lead to system instability or crashes due to accessing invalid memory. While the description does not explicitly mention exploitation scenarios, such memory errors can sometimes be leveraged to leak sensitive information or cause denial of service conditions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for out-of-bounds read errors related to xfs symlink repair operations. Specifically, look for BUG reports mentioning KFENCE out-of-bounds reads in functions like memcpy_orig and xrep_symlink_salvage. You can check kernel logs using commands such as 'dmesg | grep -i xfs' or 'journalctl -k | grep -i xfs'. Additionally, running xfs scrub operations and monitoring for errors may help detect the issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this xfs out-of-bounds memory read vulnerability has been fixed. Avoid running xfs symlink repair or scrub operations on affected systems until patched. If possible, restrict access to xfs ioctl operations that trigger the vulnerable code paths to trusted users only.