{"id":"CVE-2025-40241","state":"PUBLISHED","title":"erofs: fix crafted invalid cases for encoded extents","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix crafted invalid cases for encoded extents\n\nRobert recently reported two corrupted images that can cause system\ncrashes, which are related to the new encoded extents introduced\nin Linux 6.15:\n\n  - The first one [1] has plen != 0 (e.g. plen == 0x2000000) but\n    (plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent\n    special extents such as sparse extents (!EROFS_MAP_MAPPED), but\n    previously only plen == 0 was handled;\n\n  - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000,\n    then \"cur [0xfffffffffffff000] += bvec.bv_len [0x1000]\" in\n    \"} while ((cur += bvec.bv_len) < end);\" wraps around, causing an\n    out-of-bound access of pcl->compressed_bvecs[] in\n    z_erofs_submit_queue().  EROFS only supports 48-bit physical block\n    addresses (up to 1EiB for 4k blocks), so add a sanity check to\n    enforce this.","publishedAt":"2025-12-04T15:31:30.594Z","updatedAt":"2026-08-05T12:08:45.194Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1d191b4ca51d73699cb127386b95ac152af2b930","status":"affected","lessThan":"00d8fe0b72f4ca0a983abced36aad2160038c421","versionType":"git"},{"version":"1d191b4ca51d73699cb127386b95ac152af2b930","status":"affected","lessThan":"a429b76114aaca3ef1aff4cd469dcf025431bd11","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/erofs/zmap.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.17.6","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/erofs/zmap.c"]}],"references":["https://git.kernel.org/stable/c/00d8fe0b72f4ca0a983abced36aad2160038c421","https://git.kernel.org/stable/c/a429b76114aaca3ef1aff4cd469dcf025431bd11"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40241.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40241","state":"PUBLISHED","datePublished":"2025-12-04T15:31:30.594Z","dateUpdated":"2026-08-05T12:08:45.194Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.181Z"},"containers":{"cna":{"title":"erofs: fix crafted invalid cases for encoded extents","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix crafted invalid cases for encoded extents\n\nRobert recently reported two corrupted images that can cause system\ncrashes, which are related to the new encoded extents introduced\nin Linux 6.15:\n\n  - The first one [1] has plen != 0 (e.g. plen == 0x2000000) but\n    (plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent\n    special extents such as sparse extents (!EROFS_MAP_MAPPED), but\n    previously only plen == 0 was handled;\n\n  - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000,\n    then \"cur [0xfffffffffffff000] += bvec.bv_len [0x1000]\" in\n    \"} while ((cur += bvec.bv_len) < end);\" wraps around, causing an\n    out-of-bound access of pcl->compressed_bvecs[] in\n    z_erofs_submit_queue().  EROFS only supports 48-bit physical block\n    addresses (up to 1EiB for 4k blocks), so add a sanity check to\n    enforce this."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"1d191b4ca51d73699cb127386b95ac152af2b930","status":"affected","lessThan":"00d8fe0b72f4ca0a983abced36aad2160038c421","versionType":"git"},{"version":"1d191b4ca51d73699cb127386b95ac152af2b930","status":"affected","lessThan":"a429b76114aaca3ef1aff4cd469dcf025431bd11","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/erofs/zmap.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.17.6","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/erofs/zmap.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/00d8fe0b72f4ca0a983abced36aad2160038c421"},{"url":"https://git.kernel.org/stable/c/a429b76114aaca3ef1aff4cd469dcf025431bd11"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable data comes from an on-disk erofs extent record, and the bug is triggered by a local `read()`/`mmap()`/readahead on a file in a mounted erofs image via `z_erofs_aops.read_folio`. There is no network-facing service that reaches `z_erofs_map_blocks_ext()`.\nAC:L - Both `m_pa` and `m_plen` are read verbatim from the crafted image, so the attacker deterministically chooses the values that make `cur + pageofs_in + pclustersize` wrap; no race, timing window, or uncontrollable memory layout is involved. Robert Morris reproduced both cases with plain image files.\nPR:L - Once the image is mounted, any unprivileged user with read access to a file triggers the path — there is no capability check on `read_folio → z_erofs_scan_folios → z_erofs_pcluster_begin → z_erofs_submit_queue`. On Android and container hosts the attacker-supplied erofs image is mounted by the platform itself, so the attacker needs only ordinary local access.\nUI:N - In the deployments where erofs carries untrusted data (Android system/APEX/OTA images, container layers over fscache/composefs, file-backed mounts), the image is mounted automatically with no human action, and the attacker then triggers the bug with their own `read()`. No victim must open a file or insert media.\nS:U - The out-of-bounds accesses to `pcl->compressed_bvecs[]` and the oversized bio_vec target the host kernel's own heap and page allocations. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `z_erofs_fill_bio_vec()` reads a `struct z_erofs_bvec` from beyond the pcluster slab object and dereferences its `.page` as a real `struct page *` (`page_folio()`, `folio->private`, `folio->mapping`), giving an attacker-steerable kernel read; the oversized bio_vec additionally makes the kernel treat memory past a single page as an I/O buffer whose contents the decompressor copies into page-cache folios readable from userspace.\nI:H - `pcl->compressed_bvecs[nr].page = page` in `z_erofs_fill_bio_vec()` stores a kernel pointer past the end of the pcluster slab object at an attacker-influenced index, and the expanded `bvec.bv_len = end - cur` (up to ~1 MiB on one order-0 page) lets `vfs_iocb_iter_read()` in `erofs_fileio_rq_submit()` write attacker-controlled image bytes linearly over adjacent memory — a full heap overwrite primitive.\nA:H - The maintainer reports these crafted images \"cause system crashes\"; dereferencing and refcounting a garbage `struct page *` from the out-of-bounds bvec, plus slab corruption from the out-of-bounds store, reliably produce oopses, KASAN splats, and panics."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:08:45.194Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.17.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}