CVE-2025-40198 (GCVE-0-2025-40198)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:56 – Updated: 2026-08-05 12:08
VLAI
Title
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden parse_apply_sb_mount_options() by treating s_mount_opts as a potential __nonstring.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 , < 7bf46ff83a0ef11836e38ebd72cdc5107209342d (git)
Affected: 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 , < b2bac84fde28fb6a88817b8b761abda17a1d300b (git)
Affected: 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 , < e651294218d2684302ee5ed95ccf381646f3e5b4 (git)
Affected: 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 , < 01829af7656b56d83682b3491265d583d502e502 (git)
Affected: 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 , < 2a0cf438320cdb783e0378570744c0ef0d83e934 (git)
Affected: 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 , < a6e94557cd05adc82fae0400f6e17745563e5412 (git)
Affected: 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 , < 8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.36
Unaffected: 0 , < 2.6.36 (semver)
Unaffected: 5.4.301 , ≤ 5.4.* (semver)
Unaffected: 5.10.246 , ≤ 5.10.* (semver)
Unaffected: 6.1.158 , ≤ 6.1.* (semver)
Unaffected: 6.6.114 , ≤ 6.6.* (semver)
Unaffected: 6.12.54 , ≤ 6.12.* (semver)
Unaffected: 6.17.4 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7bf46ff83a0ef11836e38ebd72cdc5107209342d",
              "status": "affected",
              "version": "8b67f04ab9de5d8f3a71aef72bf02c995a506db5",
              "versionType": "git"
            },
            {
              "lessThan": "b2bac84fde28fb6a88817b8b761abda17a1d300b",
              "status": "affected",
              "version": "8b67f04ab9de5d8f3a71aef72bf02c995a506db5",
              "versionType": "git"
            },
            {
              "lessThan": "e651294218d2684302ee5ed95ccf381646f3e5b4",
              "status": "affected",
              "version": "8b67f04ab9de5d8f3a71aef72bf02c995a506db5",
              "versionType": "git"
            },
            {
              "lessThan": "01829af7656b56d83682b3491265d583d502e502",
              "status": "affected",
              "version": "8b67f04ab9de5d8f3a71aef72bf02c995a506db5",
              "versionType": "git"
            },
            {
              "lessThan": "2a0cf438320cdb783e0378570744c0ef0d83e934",
              "status": "affected",
              "version": "8b67f04ab9de5d8f3a71aef72bf02c995a506db5",
              "versionType": "git"
            },
            {
              "lessThan": "a6e94557cd05adc82fae0400f6e17745563e5412",
              "status": "affected",
              "version": "8b67f04ab9de5d8f3a71aef72bf02c995a506db5",
              "versionType": "git"
            },
            {
              "lessThan": "8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8",
              "status": "affected",
              "version": "8b67f04ab9de5d8f3a71aef72bf02c995a506db5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.114",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid potential buffer over-read in parse_apply_sb_mount_options()\n\nUnlike other strings in the ext4 superblock, we rely on tune2fs to\nmake sure s_mount_opts is NUL terminated.  Harden\nparse_apply_sb_mount_options() by treating s_mount_opts as a potential\n__nonstring."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through `__ext4_fill_super()` during the `mount(2)` syscall path, requiring local access to attach the crafted ext4 image (loop device, disk file, or removable media). There is no network-facing path to `parse_apply_sb_mount_options()`.\nAC:L - The attacker fully controls the on-disk superblock and merely has to fill all 64 bytes of `s_mount_opts` with non-NUL data to defeat the termination assumption; no race, no timing, no memory-layout condition outside the attacker\u0027s control.\nPR:N - The attacker needs no account or privilege on the target system \u2014 they only supply the malicious filesystem image (USB stick, disk file, virtual disk), and the privileged mount is performed by the victim or by an automounter such as udisks2 on desktops and kiosks.\nUI:R - A user or automounter must actually mount the attacker-supplied ext4 filesystem, since `ext4_fs_type` lacks `FS_USERNS_MOUNT` and the code path runs only at `ext4_fill_super()` time.\nS:U - The over-read and its consequences are confined to the kernel\u0027s own memory and the mounting host\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An unterminated `s_mount_opts` causes reads past the 64-byte field into adjacent superblock-buffer and page memory, and on parse failure `ext4_msg()` prints the resulting string verbatim into the kernel log, disclosing out-of-bounds kernel memory; the read is not bounded to a few bytes.\nI:H - The over-read bytes are handed to `parse_options()` and `ext4_apply_options()`, so uncontrolled out-of-bounds kernel memory determines mount state such as journal mode, error behavior, and quota file names on the newly mounted filesystem.\nA:H - With a 1024-byte block buffer at the end of a page, the over-read can walk into unmapped memory and oops the kernel, and on KASAN/hardened builds the out-of-bounds access panics the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:27.771Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7bf46ff83a0ef11836e38ebd72cdc5107209342d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2bac84fde28fb6a88817b8b761abda17a1d300b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e651294218d2684302ee5ed95ccf381646f3e5b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/01829af7656b56d83682b3491265d583d502e502"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a0cf438320cdb783e0378570744c0ef0d83e934"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6e94557cd05adc82fae0400f6e17745563e5412"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8"
        }
      ],
      "title": "ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40198",
    "datePublished": "2025-11-12T21:56:33.220Z",
    "dateReserved": "2025-04-16T07:20:57.178Z",
    "dateUpdated": "2026-08-05T12:08:27.771Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40198",
      "date": "2026-08-05",
      "epss": "0.0015",
      "percentile": "0.04655"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-07T01:51:18.000Z",
      "cve": "CVE-2025-40198",
      "id": "msrc_CVE-2025-40198",
      "initial_release_date": "2025-11-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40198.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40198\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-12T22:15:46.923\",\"lastModified\":\"2026-07-30T06:24:17.010\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: avoid potential buffer over-read in parse_apply_sb_mount_options()\\n\\nUnlike other strings in the ext4 superblock, we rely on tune2fs to\\nmake sure s_mount_opts is NUL terminated.  Harden\\nparse_apply_sb_mount_options() by treating s_mount_opts as a potential\\n__nonstring.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ext4/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8b67f04ab9de5d8f3a71aef72bf02c995a506db5\",\"lessThan\":\"7bf46ff83a0ef11836e38ebd72cdc5107209342d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b67f04ab9de5d8f3a71aef72bf02c995a506db5\",\"lessThan\":\"b2bac84fde28fb6a88817b8b761abda17a1d300b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b67f04ab9de5d8f3a71aef72bf02c995a506db5\",\"lessThan\":\"e651294218d2684302ee5ed95ccf381646f3e5b4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b67f04ab9de5d8f3a71aef72bf02c995a506db5\",\"lessThan\":\"01829af7656b56d83682b3491265d583d502e502\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b67f04ab9de5d8f3a71aef72bf02c995a506db5\",\"lessThan\":\"2a0cf438320cdb783e0378570744c0ef0d83e934\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b67f04ab9de5d8f3a71aef72bf02c995a506db5\",\"lessThan\":\"a6e94557cd05adc82fae0400f6e17745563e5412\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b67f04ab9de5d8f3a71aef72bf02c995a506db5\",\"lessThan\":\"8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ext4/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.36\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.36\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.301\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.246\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.158\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.114\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.54\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.4\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01829af7656b56d83682b3491265d583d502e502\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2a0cf438320cdb783e0378570744c0ef0d83e934\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7bf46ff83a0ef11836e38ebd72cdc5107209342d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a6e94557cd05adc82fae0400f6e17745563e5412\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b2bac84fde28fb6a88817b8b761abda17a1d300b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e651294218d2684302ee5ed95ccf381646f3e5b4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:08:00+00:00",
      "cve": "CVE-2025-40198",
      "id": "CVE-2025-40198",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40198.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.