Skip to main content

Linux Kernel CVE-2025-40198

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.1 HIGH

Local, mount-triggered over-read reachable via automounted removable media (PR:N/UI:R); primitive leaks memory (C:H) and can panic the kernel (A:H) but does not corrupt data (I:N).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
4.4 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 08:29 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 08:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 28, 2026 - 19:31 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 22:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()

Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden parse_apply_sb_mount_options() by treating s_mount_opts as a potential __nonstring.

AnalysisAI

Out-of-bounds buffer over-read in the Linux kernel ext4 filesystem driver allows disclosure of adjacent kernel memory or a system crash when a maliciously crafted ext4 superblock is mounted. The flaw lives in parse_apply_sb_mount_options(), which trusted the s_mount_opts field to be NUL-terminated (a guarantee normally provided only by tune2fs); a non-terminated string causes the parser to read past the buffer. There is no public exploit identified at time of analysis, and EPSS rates practical exploitation as very low (0.07%), consistent with a local-only, mount-triggered issue rather than a remote mass-exploitation candidate.

Technical ContextAI

The bug is in the ext4 filesystem's superblock mount-option handling. When an ext4 volume is mounted, the kernel copies default mount options embedded in the on-disk superblock (s_mount_opts) and parses them via parse_apply_sb_mount_options(). Unlike other ext4 superblock strings, s_mount_opts has no in-kernel length/termination enforcement - the userspace tool tune2fs is relied upon to write a NUL-terminated value. An attacker-controlled image can omit the terminator, so string-parsing routines walk past the fixed on-disk field into adjacent memory. The root-cause class is CWE-125 (Out-of-bounds Read); the NVD entry lists CWE as N/A, so that mapping is inferred from the description ('buffer over-read' / '__nonstring'). The fix hardens the parser by treating s_mount_opts as a potential __nonstring and bounding the read.

Affected ProductsAI

The vulnerability affects the Linux kernel ext4 filesystem across multiple maintained stable branches, as evidenced by seven separate stable-tree fix commits (git.kernel.org commits 01829af7, 2a0cf438, 7bf46ff8, 8ecb790e, a6e94557, b2bac84f, e6512942), each backporting the fix to a different longterm/stable series. No exact CPE strings were provided in the input, so specific version ranges must be derived from the distribution advisories: Canonical documents affected and fixed kernel packages in Ubuntu Security Notices USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1). Any kernel build that includes ext4 and mounts untrusted ext4 images before the fix commit is affected.

RemediationAI

Patch available per vendor advisory: apply the upstream ext4 fix (kernel.org stable commits 01829af7656b, 2a0cf438320c, 7bf46ff83a0e, 8ecb790ea8c3, a6e94557cd05, b2bac84fde28, e651294218d2) by updating to the fixed kernel package for your branch - Ubuntu users should install the versions listed in USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and reboot into the new kernel; users of other distributions should take the equivalent stable-kernel update. As a compensating control until patched, prevent mounting of untrusted ext4 filesystems: disable USB/removable-media automounting (e.g. stop udisks2 auto-mount or set udev rules to ignore removable block devices), restrict the mount capability by ensuring only privileged administrators can mount filesystems (avoid user/automount fstab entries for ext4), and treat externally supplied disk images as untrusted. The trade-off is loss of convenience automounting and manual review of any external media, which is acceptable in servers, kiosks, and multi-tenant hosts where this exposure matters most.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.82 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.55 Affected

Share

CVE-2025-40198 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy