CVE-2025-40295
BaseFortify
Publication date: 2025-12-08
Last updated on: 2025-12-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a left shift underflow in the Linux kernel's fscrypt component. It occurs when the inode's i_blkbits value is greater than PAGE_SHIFT, causing a left shift by a negative number (-1), which triggers an undefined behavior sanitizer (UBSAN) warning. This happens specifically when simulating an NVMe device on QEMU with both logical and physical block sizes set to 8 KiB, leading to an error trace during partition table reading at boot time.
How can this vulnerability impact me? :
The vulnerability can cause errors and warnings during block device operations, such as reading partition tables at boot time, potentially leading to system instability or crashes when using certain block device configurations (e.g., NVMe devices simulated in QEMU with specific block sizes). However, typical file I/O operations and filesystems without the FS_LBS feature are not affected.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the specific UBSAN (Undefined Behavior Sanitizer) warning related to a shift-out-of-bounds error in the kernel logs. You can look for messages similar to: 'UBSAN: shift-out-of-bounds in fs/crypto/inline_crypt.c' and 'shift exponent -1 is negative'. To detect this, you can use the following command to search the kernel log for the error trace: sudo dmesg | grep -i 'UBSAN: shift-out-of-bounds' or sudo journalctl -k | grep -i 'UBSAN: shift-out-of-bounds'. These logs indicate the left shift underflow issue caused by inode->i_blkbits being larger than PAGE_SHIFT.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by correcting the left shift underflow when inode->i_blkbits is greater than PAGE_SHIFT. In the meantime, avoid configurations that set both logical_block_size and physical_block_size to 8 KiB on simulated nvme devices in QEMU, or disable CONFIG_TRANSPARENT_HUGEPAGE if possible to prevent inode->i_blkbits from exceeding PAGE_SHIFT. Monitoring kernel logs for the UBSAN warning can also help in early detection.