{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40241", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.181Z", "datePublished": "2025-12-04T15:31:30.594Z", "dateUpdated": "2026-08-05T12:08:45.194Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:45.194Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix crafted invalid cases for encoded extents\n\nRobert recently reported two corrupted images that can cause system\ncrashes, which are related to the new encoded extents introduced\nin Linux 6.15:\n\n - The first one [1] has plen != 0 (e.g. plen == 0x2000000) but\n (plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent\n special extents such as sparse extents (!EROFS_MAP_MAPPED), but\n previously only plen == 0 was handled;\n\n - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000,\n then \"cur [0xfffffffffffff000] += bvec.bv_len [0x1000]\" in\n \"} while ((cur += bvec.bv_len) < end);\" wraps around, causing an\n out-of-bound access of pcl->compressed_bvecs[] in\n z_erofs_submit_queue(). EROFS only supports 48-bit physical block\n addresses (up to 1EiB for 4k blocks), so add a sanity check to\n enforce this." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable data comes from an on-disk erofs extent record, and the bug is triggered by a local `read()`/`mmap()`/readahead on a file in a mounted erofs image via `z_erofs_aops.read_folio`. There is no network-facing service that reaches `z_erofs_map_blocks_ext()`.\nAC:L - Both `m_pa` and `m_plen` are read verbatim from the crafted image, so the attacker deterministically chooses the values that make `cur + pageofs_in + pclustersize` wrap; no race, timing window, or uncontrollable memory layout is involved. Robert Morris reproduced both cases with plain image files.\nPR:L - Once the image is mounted, any unprivileged user with read access to a file triggers the path — there is no capability check on `read_folio → z_erofs_scan_folios → z_erofs_pcluster_begin → z_erofs_submit_queue`. On Android and container hosts the attacker-supplied erofs image is mounted by the platform itself, so the attacker needs only ordinary local access.\nUI:N - In the deployments where erofs carries untrusted data (Android system/APEX/OTA images, container layers over fscache/composefs, file-backed mounts), the image is mounted automatically with no human action, and the attacker then triggers the bug with their own `read()`. No victim must open a file or insert media.\nS:U - The out-of-bounds accesses to `pcl->compressed_bvecs[]` and the oversized bio_vec target the host kernel's own heap and page allocations. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `z_erofs_fill_bio_vec()` reads a `struct z_erofs_bvec` from beyond the pcluster slab object and dereferences its `.page` as a real `struct page *` (`page_folio()`, `folio->private`, `folio->mapping`), giving an attacker-steerable kernel read; the oversized bio_vec additionally makes the kernel treat memory past a single page as an I/O buffer whose contents the decompressor copies into page-cache folios readable from userspace.\nI:H - `pcl->compressed_bvecs[nr].page = page` in `z_erofs_fill_bio_vec()` stores a kernel pointer past the end of the pcluster slab object at an attacker-influenced index, and the expanded `bvec.bv_len = end - cur` (up to ~1 MiB on one order-0 page) lets `vfs_iocb_iter_read()` in `erofs_fileio_rq_submit()` write attacker-controlled image bytes linearly over adjacent memory — a full heap overwrite primitive.\nA:H - The maintainer reports these crafted images \"cause system crashes\"; dereferencing and refcounting a garbage `struct page *` from the out-of-bounds bvec, plus slab corruption from the out-of-bounds store, reliably produce oopses, KASAN splats, and panics." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/erofs/zmap.c" ], "versions": [ { "version": "1d191b4ca51d73699cb127386b95ac152af2b930", "lessThan": "00d8fe0b72f4ca0a983abced36aad2160038c421", "status": "affected", "versionType": "git" }, { "version": "1d191b4ca51d73699cb127386b95ac152af2b930", "lessThan": "a429b76114aaca3ef1aff4cd469dcf025431bd11", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/erofs/zmap.c" ], "versions": [ { "version": "6.15", "status": "affected" }, { "version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.6", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.17.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/00d8fe0b72f4ca0a983abced36aad2160038c421" }, { "url": "https://git.kernel.org/stable/c/a429b76114aaca3ef1aff4cd469dcf025431bd11" } ], "title": "erofs: fix crafted invalid cases for encoded extents", "x_generator": { "engine": "bippy-1.2.0" } } } }