CVE-2025-40241
In the Linux kernel, the following vulnerability has been resolved: erofs: fix crafted invalid cases for encoded extents Robert recently reported two corrupted images that can cause system crashes, which are related to the new encoded extents introduced in Linux 6.15: - The first one [1] has plen != 0 (e.g. plen == 0x2000000) but (plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent special extents such as sparse extents (!EROFS_MAP_MAPPED), but previously only plen == 0 was handled; - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000, then "cur [0xfffffffffffff000] += bvec.bv_len [0x1000]" in "} while ((cur += bvec.bv_len) < end);" wraps around, causing an out-of-bound access of pcl->compressed_bvecs[] in z_erofs_submit_queue(). EROFS only supports 48-bit physical block addresses (up to 1EiB for 4k blocks), so add a sanity check to enforce this.
Affected versions
Linux kernel versions
6.15
and later are affected. Fixed in
6.17.6,
6.18
and their respective stable series.
References
The following references provide additional information about CVE-2025-40241 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/00d8fe0b72f4ca0a983abced36aad2160038c421
-
PatchKernel patch commithttps://git.kernel.org/stable/c/a429b76114aaca3ef1aff4cd469dcf025431bd11
Frequently asked questions
-
What is CVE-2025-40241?
CVE-2025-40241 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.15 onward and has been patched in 6.17.6 and 6.18. CVE-2025-40241 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2025-40241?
Yes — CVE-2025-40241 has been patched. Fixed versions include 6.17.6 and 6.18. If you are running Linux kernel 6.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2025-40241 actively exploited?
No — CVE-2025-40241 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.