{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40241","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.181Z","datePublished":"2025-12-04T15:31:30.594Z","dateUpdated":"2026-08-05T12:08:45.194Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:08:45.194Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix crafted invalid cases for encoded extents\n\nRobert recently reported two corrupted images that can cause system\ncrashes, which are related to the new encoded extents introduced\nin Linux 6.15:\n\n  - The first one [1] has plen != 0 (e.g. plen == 0x2000000) but\n    (plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent\n    special extents such as sparse extents (!EROFS_MAP_MAPPED), but\n    previously only plen == 0 was handled;\n\n  - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000,\n    then \"cur [0xfffffffffffff000] += bvec.bv_len [0x1000]\" in\n    \"} while ((cur += bvec.bv_len) < end);\" wraps around, causing an\n    out-of-bound access of pcl->compressed_bvecs[] in\n    z_erofs_submit_queue().  EROFS only supports 48-bit physical block\n    addresses (up to 1EiB for 4k blocks), so add a sanity check to\n    enforce this."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable data comes from an on-disk erofs extent record, and the bug is triggered by a local `read()`/`mmap()`/readahead on a file in a mounted erofs image via `z_erofs_aops.read_folio`. There is no network-facing service that reaches `z_erofs_map_blocks_ext()`.\nAC:L - Both `m_pa` and `m_plen` are read verbatim from the crafted image, so the attacker deterministically chooses the values that make `cur + pageofs_in + pclustersize` wrap; no race, timing window, or uncontrollable memory layout is involved. Robert Morris reproduced both cases with plain image files.\nPR:L - Once the image is mounted, any unprivileged user with read access to a file triggers the path — there is no capability check on `read_folio → z_erofs_scan_folios → z_erofs_pcluster_begin → z_erofs_submit_queue`. On Android and container hosts the attacker-supplied erofs image is mounted by the platform itself, so the attacker needs only ordinary local access.\nUI:N - In the deployments where erofs carries untrusted data (Android system/APEX/OTA images, container layers over fscache/composefs, file-backed mounts), the image is mounted automatically with no human action, and the attacker then triggers the bug with their own `read()`. No victim must open a file or insert media.\nS:U - The out-of-bounds accesses to `pcl->compressed_bvecs[]` and the oversized bio_vec target the host kernel's own heap and page allocations. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `z_erofs_fill_bio_vec()` reads a `struct z_erofs_bvec` from beyond the pcluster slab object and dereferences its `.page` as a real `struct page *` (`page_folio()`, `folio->private`, `folio->mapping`), giving an attacker-steerable kernel read; the oversized bio_vec additionally makes the kernel treat memory past a single page as an I/O buffer whose contents the decompressor copies into page-cache folios readable from userspace.\nI:H - `pcl->compressed_bvecs[nr].page = page` in `z_erofs_fill_bio_vec()` stores a kernel pointer past the end of the pcluster slab object at an attacker-influenced index, and the expanded `bvec.bv_len = end - cur` (up to ~1 MiB on one order-0 page) lets `vfs_iocb_iter_read()` in `erofs_fileio_rq_submit()` write attacker-controlled image bytes linearly over adjacent memory — a full heap overwrite primitive.\nA:H - The maintainer reports these crafted images \"cause system crashes\"; dereferencing and refcounting a garbage `struct page *` from the out-of-bounds bvec, plus slab corruption from the out-of-bounds store, reliably produce oopses, KASAN splats, and panics."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/erofs/zmap.c"],"versions":[{"version":"1d191b4ca51d73699cb127386b95ac152af2b930","lessThan":"00d8fe0b72f4ca0a983abced36aad2160038c421","status":"affected","versionType":"git"},{"version":"1d191b4ca51d73699cb127386b95ac152af2b930","lessThan":"a429b76114aaca3ef1aff4cd469dcf025431bd11","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/erofs/zmap.c"],"versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","status":"unaffected","versionType":"semver"},{"version":"6.17.6","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.17.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/00d8fe0b72f4ca0a983abced36aad2160038c421"},{"url":"https://git.kernel.org/stable/c/a429b76114aaca3ef1aff4cd469dcf025431bd11"}],"title":"erofs: fix crafted invalid cases for encoded extents","x_generator":{"engine":"bippy-1.2.0"}}}}