CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix out of bounds memory read error in symlink repair
xfs/286 produced this report on my test fleet:
================================================================== BUG: KFENCE: out-of-bounds read in memcpyorig+0x54/0x110
Out-of-bounds read at 0xffff88843fe9e038 (184B right of kfence-#184): memcpyorig+0x54/0x110 xrepsymlinksalvageinline+0xb3/0xf0 [xfs] xrepsymlinksalvage+0x100/0x110 [xfs] xrepsymlink+0x2e/0x80 [xfs] xrepattempt+0x61/0x1f0 [xfs] xfsscrubmetadata+0x34f/0x5c0 [xfs] xfsiocscrubvmetadata+0x387/0x560 [xfs] xfsfileioctl+0xe23/0x10e0 [xfs] x64sysioctl+0x76/0xc0 dosyscall64+0x4e/0x1e0 entrySYSCALL64afterhwframe+0x4b/0x53
kfence-#184: 0xffff88843fe9df80-0xffff88843fe9dfea, size=107, cache=kmalloc-128
allocated by task 3470 on cpu 1 at 263329.131592s (192823.508886s ago): xfsinitlocalfork+0x79/0xe0 [xfs] xfsiformatlocal+0xa4/0x170 [xfs] xfsiformatdatafork+0x148/0x180 [xfs] xfsinodefromdisk+0x2cd/0x480 [xfs] xfsiget+0x450/0xd60 [xfs] xfsbulkstatoneint+0x6b/0x510 [xfs] xfsbulkstatiwalk+0x1e/0x30 [xfs] xfsiwalkagrecs+0xdf/0x150 [xfs] xfsiwalkruncallbacks+0xb9/0x190 [xfs] xfsiwalkag+0x1dc/0x2f0 [xfs] xfsiwalkargs.constprop.0+0x6a/0x120 [xfs] xfsiwalk+0xa4/0xd0 [xfs] xfsbulkstat+0xfa/0x170 [xfs] xfsiocfsbulkstat.isra.0+0x13a/0x230 [xfs] xfsfileioctl+0xbf2/0x10e0 [xfs] x64sysioctl+0x76/0xc0 dosyscall64+0x4e/0x1e0 entrySYSCALL64afterhwframe+0x4b/0x53
CPU: 1 UID: 0 PID: 1300113 Comm: xfsscrub Not tainted 6.18.0-rc4-djwx #rc4 PREEMPT(lazy) 3d744dd94e92690f00a04398d2bd8631dcef1954 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014 ==================================================================
On further analysis, I realized that the second parameter to min() is not correct. xfsifork::ifbytes is the size of the xfsifork::ifdata buffer. ifbytes can be smaller than the data fork size because:
(a) the forkoff code tries to keep the data area as large as possible (b) for symbolic links, ifbytes is the ondisk file size + 1 (c) forkoff is always a multiple of 8.
Case in point: for a single-byte symlink target, forkoff will be 8 but the buffer will only be 2 bytes long.
In other words, the logic here is wrong and we walk off the end of the incore buffer. Fix that.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40246?
CVE-2025-40246 is classified as a medium severity vulnerability due to the potential for out-of-bounds memory read errors.
How do I fix CVE-2025-40246?
To fix CVE-2025-40246, update the Linux kernel to the latest stable version where the vulnerability has been patched.
What systems are affected by CVE-2025-40246?
CVE-2025-40246 affects the Linux kernel, particularly versions that include the XFS file system.
What are the potential impacts of CVE-2025-40246?
The potential impacts of CVE-2025-40246 include system crashes and security vulnerabilities that could be exploited by attackers.
Is CVE-2025-40246 being actively exploited?
As of the latest information, there are no confirmed reports of active exploitation of CVE-2025-40246 in the wild.