Executive brief
A vulnerability in the Linux kernel's EXT4 file system could allow a local attacker to cause a system crash or potentially access sensitive information. The issue occurs when the system processes specific file system mount options that are not properly terminated, leading to an unintended memory read. This typically requires a user to interact with a specially crafted storage device or file system image.
Technical details
A buffer over-read vulnerability exists in the Linux kernel's EXT4 implementation within the 'parse_apply_sb_mount_options()' and 'ext4_fill_super()' functions. The root cause is the kernel's reliance on external tools (like tune2fs) to ensure the 's_mount_opts' field in the EXT4 superblock is NUL-terminated. If a maliciously crafted or corrupted superblock contains a non-terminated string in this field, functions like 'kstrndup' may read past the intended buffer boundaries. An attacker could exploit this by providing a specially crafted file system image, potentially leading to a kernel oops (denial of service) or disclosure of kernel memory. The fix involves using 'strscpy_pad' to safely copy the mount options into a fixed-size, NUL-terminated buffer.
Affected products
- Linux Linux Kernel 2.6.36 to 6.12.54
Timeline
- 2025-09-16: disclosed: Initial patch submitted by Theodore Ts'o
- 2025-11-12: advisory: CVE-2025-40198 published
References
- https://git.kernel.org/stable/c/01829af7656b56d83682b3491265d583d502e502
- https://git.kernel.org/stable/c/2a0cf438320cdb783e0378570744c0ef0d83e934
- https://git.kernel.org/stable/c/7bf46ff83a0ef11836e38ebd72cdc5107209342d
- https://git.kernel.org/stable/c/8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8
- https://git.kernel.org/stable/c/a6e94557cd05adc82fae0400f6e17745563e5412
- https://git.kernel.org/stable/c/b2bac84fde28fb6a88817b8b761abda17a1d300b
- https://git.kernel.org/stable/c/e651294218d2684302ee5ed95ccf381646f3e5b4