CVE-2025-71123: ext4: fix string copying in parse_apply_sb_mount_options()
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix string copying in parseapplysbmountoptions()
strscpypad() can't be used to copy a non-NUL-term string into a NUL-term string of possibly bigger size. Commit 0efc5990bca5 ("string.h: Introduce memtostr() and memtostrpad()") provides additional information in that regard. So if this happens, the following warning is observed:
strnlen: detected buffer overflow: 65 byte read of buffer size 64 WARNING: CPU: 0 PID: 28655 at lib/stringhelpers.c:1032 fortifyreport+0x96/0xc0 lib/stringhelpers.c:1032 Modules linked in: CPU: 0 UID: 0 PID: 28655 Comm: syz-executor.3 Not tainted 6.12.54-syzkaller-00144-g5f0270f1ba00 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:fortifyreport+0x96/0xc0 lib/stringhelpers.c:1032 Call Trace: <TASK> fortifypanic+0x1f/0x30 lib/stringhelpers.c:1039 strnlen include/linux/fortify-string.h:235 [inline] sizedstrscpy include/linux/fortify-string.h:309 [inline] parseapplysbmountoptions fs/ext4/super.c:2504 [inline] ext4fillsuper fs/ext4/super.c:5261 [inline] ext4fillsuper+0x3c35/0xad00 fs/ext4/super.c:5706 gettreebdevflags+0x387/0x620 fs/super.c:1636 vfsgettree+0x93/0x380 fs/super.c:1814 donewmount fs/namespace.c:3553 [inline] pathmount+0x6ae/0x1f70 fs/namespace.c:3880 domount fs/namespace.c:3893 [inline] dosysmount fs/namespace.c:4103 [inline] sesysmount fs/namespace.c:4080 [inline] x64sysmount+0x280/0x300 fs/namespace.c:4080 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0x64/0x140 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x76/0x7e
Since userspace is expected to provide smountopts field to be at most 63 characters long with the ending byte being NUL-term, use a 64-byte buffer which matches the size of smountopts, so that strscpypad() does its job properly. Return with error if the user still managed to provide a non-NUL-term string here.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71123?
CVE-2025-71123 has been classified as a medium severity vulnerability.
How does CVE-2025-71123 affect the Linux kernel?
CVE-2025-71123 affects the parsing of string copying in the ext4 filesystem, which could lead to improper handling of mount options.
How can I mitigate CVE-2025-71123?
To mitigate CVE-2025-71123, updating to the latest stable version of the Linux kernel where the patch is applied is recommended.
What versions of the Linux kernel are affected by CVE-2025-71123?
CVE-2025-71123 affects specific versions of the Linux kernel that utilize the ext4 filesystem and include the vulnerable parsing function.
Is a restart required after patching CVE-2025-71123?
Yes, a system restart is typically required after applying the patch for CVE-2025-71123 to ensure the changes take effect.