cbcvebase.
CVE-2025-40205
published 2025-11-12

CVE-2025-40205: In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh()…

PriorityP344high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.9th percentile
In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8 dwords, 32 bytes). However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (10 dwords, 40 bytes). If *max_len is not large enough, this write goes out of bounds because BTRFS_FID_SIZE_CONNECTABLE_ROOT is greater than BTRFS_FID_SIZE_CONNECTABLE originally returned. This results in an 8-byte out-of-bounds write at fid->parent_root_objectid = parent_root_id. A previous attempt to fix this issue was made but was lost. https://lore.kernel.org/all/[email protected]/ Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data.

Affected

32 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.158-1 (bookworm)linux 6.1.158-1 (bookworm)
debianlinux-6.1< linux 6.1.158-1 (bookworm)linux 6.1.158-1 (bookworm)
linuxlinux
linuxlinux>= be6e8dc0ba84029997075a1ec77b4ddb863cbe15 < 60de2f55d2aca53e81b4ef2a67d7cc9e1eb677db60de2f55d2aca53e81b4ef2a67d7cc9e1eb677db
linuxlinux>= be6e8dc0ba84029997075a1ec77b4ddb863cbe15 < 742b44342204e5dfe3926433823623c1a0c581df742b44342204e5dfe3926433823623c1a0c581df
linuxlinux>= be6e8dc0ba84029997075a1ec77b4ddb863cbe15 < d3a9a8e1275eb9b87f006b5562a287aea3f6885fd3a9a8e1275eb9b87f006b5562a287aea3f6885f
linuxlinux>= be6e8dc0ba84029997075a1ec77b4ddb863cbe15 < d91f6626133698362bba08fbc04bd72c466806d3d91f6626133698362bba08fbc04bd72c466806d3
linuxlinux>= be6e8dc0ba84029997075a1ec77b4ddb863cbe15 < 0276c8582488022f057b4cec21975a5edf079f470276c8582488022f057b4cec21975a5edf079f47
linuxlinux>= be6e8dc0ba84029997075a1ec77b4ddb863cbe15 < 361d67276eb8ec6be8f27f4ad6c6090459438fee361d67276eb8ec6be8f27f4ad6c6090459438fee
linuxlinux>= be6e8dc0ba84029997075a1ec77b4ddb863cbe15 < 43143776b0a7604d873d1a6f3e552a00aa93022443143776b0a7604d873d1a6f3e552a00aa930224
linuxlinux>= be6e8dc0ba84029997075a1ec77b4ddb863cbe15 < dff4f9ff5d7f289e4545cc936362e01ed3252742dff4f9ff5d7f289e4545cc936362e01ed3252742
linuxlinux_kernel>= 0 < 5.10.247-15.10.247-1
linuxlinux_kernel>= 0 < 6.1.158-16.1.158-1
linuxlinux_kernel>= 0 < 6.12.57-16.12.57-1
linuxlinux_kernel>= 0 < 6.17.6-16.17.6-1
linuxlinux_kernel>= 0 < 5.15.0-170.1805.15.0-170.180
linuxlinux_kernel>= 0 < 6.8.0-106.1066.8.0-106.106
linuxlinux_kernel>= 0 < 6.17.0-14.146.17.0-14.14
linuxlinux_kernel>= 2.6.29 < 5.4.3015.4.301
linuxlinux_kernel>= 5.11.0 < 5.15.1955.15.195
linuxlinux_kernel>= 5.16.0 < 6.1.1576.1.157
linuxlinux_kernel>= 5.5.0 < 5.10.2465.10.246
linuxlinux_kernel>= 6.13.0 < 6.17.46.17.4
linuxlinux_kernel>= 6.2.0 < 6.6.1136.6.113
linuxlinux_kernel>= 6.7.0 < 6.12.546.12.54

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_msrc7.8HIGH
vendor_ubuntu7.8HIGH
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.