CVE-2025-40246— xfs: fix out of bounds memory read error in symlink repair
Possible ATT&CK Techniques 1AI
T1083 · File and Directory DiscoveryAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 2651923d8d8db00a57665822f017fa7c76758044< 7c2d68e091584149fe89bcbaf9b99b3162d46ee7 | affected |
2651923d8d8db00a57665822f017fa7c76758044< 81a8685cac4bf081c93a7df591644f4f80240bb9 | affected | ||
2651923d8d8db00a57665822f017fa7c76758044< 678e1cc2f482e0985a0613ab4a5bf89c497e5acc | affected | ||
6.10 | affected | ||
< 6.10 | unaffected | ||
6.12.60≤ 6.12.* | unaffected | ||
6.17.10≤ 6.17.* | unaffected | ||
6.18≤ * | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-40246
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
xfs: fix out of bounds memory read error in symlink repair
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report on my test fleet: ================================================================== BUG: KFENCE: out-of-bounds read in memcpy_orig+0x54/0x110 Out-of-bounds read at 0xffff88843fe9e038 (184B right of kfence-#184): memcpy_orig+0x54/0x110 xrep_symlink_salvage_inline+0xb3/0xf0 [xfs] xrep_symlink_salvage+0x100/0x110 [xfs] xrep_symlink+0x2e/0x80 [xfs] xrep_attempt+0x61/0x1f0 [xfs] xfs_scrub_metadata+0x34f/0x5c0 [xfs] xfs_ioc_scrubv_metadata+0x387/0x560 [xfs] xfs_file_ioctl+0xe23/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 kfence-#184: 0xffff88843fe9df80-0xffff88843fe9dfea, size=107, cache=kmalloc-128 allocated by task 3470 on cpu 1 at 263329.131592s (192823.508886s ago): xfs_init_local_fork+0x79/0xe0 [xfs] xfs_iformat_local+0xa4/0x170 [xfs] xfs_iformat_data_fork+0x148/0x180 [xfs] xfs_inode_from_disk+0x2cd/0x480 [xfs] xfs_iget+0x450/0xd60 [xfs] xfs_bulkstat_one_int+0x6b/0x510 [xfs] xfs_bulkstat_iwalk+0x1e/0x30 [xfs] xfs_iwalk_ag_recs+0xdf/0x150 [xfs] xfs_iwalk_run_callbacks+0xb9/0x190 [xfs] xfs_iwalk_ag+0x1dc/0x2f0 [xfs] xfs_iwalk_args.constprop.0+0x6a/0x120 [xfs] xfs_iwalk+0xa4/0xd0 [xfs] xfs_bulkstat+0xfa/0x170 [xfs] xfs_ioc_fsbulkstat.isra.0+0x13a/0x230 [xfs] xfs_file_ioctl+0xbf2/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 CPU: 1 UID: 0 PID: 1300113 Comm: xfs_scrub Not tainted 6.18.0-rc4-djwx #rc4 PREEMPT(lazy) 3d744dd94e92690f00a04398d2bd8631dcef1954 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014 ================================================================== On further analysis, I realized that the second parameter to min() is not correct. xfs_ifork::if_bytes is the size of the xfs_ifork::if_data buffer. if_bytes can be smaller than the data fork size because: (a) the forkoff code tries to keep the data area as large as possible (b) for symbolic links, if_bytes is the ondisk file size + 1 (c) forkoff is always a multiple of 8. Case in point: for a single-byte symlink target, forkoff will be 8 but the buffer will only be 2 bytes long. In other words, the logic here is wrong and we walk off the end of the incore buffer. Fix that.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于xfs符号链接修复中越界内存读取，可能导致系统崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-40246
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-40246
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-12-04 · 53 CVEs total
| CVE-2025-40261 | 9.8 CRITICAL | nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() |
| CVE-2025-40252 | 9.8 CRITICAL | net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() |
| CVE-2025-40258 | 9.8 CRITICAL | mptcp: fix race condition in mptcp_schedule_work() |
| CVE-2025-40257 | 9.8 CRITICAL | mptcp: fix a race in mptcp_pm_del_add_timer() |
| CVE-2025-40253 | 8.8 HIGH | s390/ctcm: Fix double-kfree |
| CVE-2025-40266 | 8.2 HIGH | KVM: arm64: Check the untrusted offset in FF-A memory share |
| CVE-2025-40244 | 7.8 HIGH | hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() |
| CVE-2025-40250 | 7.8 HIGH | net/mlx5: Clean up only new IRQ glue on request_irq() failure |
| CVE-2025-40262 | 7.8 HIGH | Input: imx_sc_key - fix memory corruption on unload |
| CVE-2025-40251 | 7.8 HIGH | devlink: rate: Unset parent pointer in devl_rate_nodes_destroy |
| CVE-2025-40248 | 7.8 HIGH | vsock: Ignore signal/timeout on connect() if already established |
| CVE-2025-40249 | 7.8 HIGH | gpio: cdev: make sure the cdev fd is still active before emitting events |
| CVE-2025-40245 | 7.8 HIGH | nios2: ensure that memblock.current_limit is set when setting pfn limits |
| CVE-2025-40214 | 7.8 HIGH | af_unix: Initialise scc_index in unix_add_edge(). |
| CVE-2025-40243 | 7.8 HIGH | hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() |
| CVE-2025-40241 | 7.8 HIGH | erofs: fix crafted invalid cases for encoded extents |
| CVE-2025-40233 | 7.8 HIGH | ocfs2: clear extent cache after moving/defragmenting extents |
| CVE-2025-40216 | 7.8 HIGH | io_uring/rsrc: don't rely on user vaddr alignment |
| CVE-2025-40215 | 7.8 HIGH | xfrm: delete x->tunnel as we delete x |
| CVE-2025-40240 | 7.5 HIGH | sctp: avoid NULL dereference when chunk data buffer is missing |
Showing top 20 of 53 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
Same vendor: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
V. Comments for CVE-2025-40246
No comments yet