Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-40049— Squashfs: fix uninit-value in squashfs_get_parent

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于squashfs_get_parent函数中未初始化的parent字段访问，可能导致无效inode访问。

AI Predicted 4.9 Difficulty: Hard EPSS 0.23% · P13

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 122601408d20c77704268f1dea9f9ce4abf997c2< f81a5bc9e924ee1950e0dd82bd10749048390f6e affected
122601408d20c77704268f1dea9f9ce4abf997c2< 382a47fae449e554ef1e8c198667fd2f3270b945 affected
122601408d20c77704268f1dea9f9ce4abf997c2< 61d38b5ce2782bff3cacaacbb8164087a73ed1a5 affected
122601408d20c77704268f1dea9f9ce4abf997c2< 81a2bca52d43fc9d9abf07408b91255131c5dc53 affected
122601408d20c77704268f1dea9f9ce4abf997c2< c28b0ca029edf5d0558abcd76cb8c732706cd339 affected
122601408d20c77704268f1dea9f9ce4abf997c2< 1b3ccd0019132880c94bb00ca7088c1749308f82 affected
122601408d20c77704268f1dea9f9ce4abf997c2< 91b99db7a92e57ff48a96a1b10fddfd2547e7f53 affected
122601408d20c77704268f1dea9f9ce4abf997c2< 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-40049

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Squashfs: fix uninit-value in squashfs_get_parent
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in squashfs_get_parent Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory. Squashfs_get_parent() gets called with that symbolic link inode, and accesses the parent member field. unsigned int parent_ino = squashfs_i(inode)->parent; Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access. The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned. Regular inodes used to share the parent field with the block_list_start field. This is removed in this commit to enable the parent field to contain the invalid inode number 0.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于squashfs_get_parent函数中未初始化的parent字段访问，可能导致无效inode访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 122601408d20c77704268f1dea9f9ce4abf997c2 ~ f81a5bc9e924ee1950e0dd82bd10749048390f6e -
Linux Linux 2.6.29 -

II. Public POCs for CVE-2025-40049

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-40049

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-40049 (2)

Same Patch Batch · Linux · 2025-10-28 · 58 CVEs total

CVE-2025-40074 9.8 CRITICAL ipv4: start using dst_dev_rcu()
CVE-2025-40043 8.8 HIGH net: nfc: nci: Add parameter validation for packet data
CVE-2025-40039 8.8 HIGH ksmbd: Fix race condition in RPC handle list access
CVE-2025-40058 8.8 HIGH iommu/vt-d: Disallow dirty tracking if incoherent page walk
CVE-2025-40046 8.6 HIGH io_uring/zcrx: fix overshooting recv limit
CVE-2025-40068 8.4 HIGH fs: ntfs3: Fix integer overflow in run_unpack()
CVE-2025-40075 8.1 HIGH tcp_metrics: use dst_dev_net_rcu()
CVE-2025-40026 7.9 HIGH KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
CVE-2025-40040 7.8 HIGH mm/ksm: fix flag-dropping behavior in ksm_madvise
CVE-2025-40054 7.8 HIGH f2fs: fix UAF issue in f2fs_merge_page_bio()
CVE-2025-40045 7.8 HIGH ASoC: codecs: wcd937x: set the comp soundwire port correctly
CVE-2025-40047 7.8 HIGH io_uring/waitid: always prune wait queue entry in io_waitid_wait()
CVE-2025-40051 7.8 HIGH vhost: vringh: Modify the return value check
CVE-2025-40025 7.8 HIGH f2fs: fix to do sanity check on node footer for non inode dnode
CVE-2025-40061 7.8 HIGH RDMA/rxe: Fix race in do_task() when draining
CVE-2025-40064 7.8 HIGH smc: Fix use-after-free in __pnet_find_base_ndev().
CVE-2025-40067 7.8 HIGH fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist
CVE-2025-40069 7.8 HIGH drm/msm: Fix obj leak in VM_BIND error path
CVE-2025-40079 7.8 HIGH riscv, bpf: Sign extend struct ops return values properly
CVE-2025-40081 7.8 HIGH perf: arm_spe: Prevent overflow in PERF_IDX2OFF()

Showing top 20 of 58 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-40049

No comments yet

Leave a comment