CVE-2025-40049 — Use of Uninitialized Resource in Linux
Severity
7.8HIGHOSV
OSV5.5OSV3.2
No vectorEPSS
0.1%
top 81.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 28
Latest updateApr 13
Description
In the Linux kernel, the following vulnerability has been resolved:
Squashfs: fix uninit-value in squashfs_get_parent
Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.
This is caused by open_by_handle_at() being called with a file handle
containing an invalid parent inode number. In particular the inode number
is that of a symbolic link, rather than a directory.
Squashfs_get_parent() gets called with that symbolic link inode, and
accesses the parent member field.
unsigne…
Affected Packages7 packages
▶CVEListV5linux/linux122601408d20c77704268f1dea9f9ce4abf997c2 — f81a5bc9e924ee1950e0dd82bd10749048390f6e+8