linux-cve-announce - CVE-2025-40049: Squashfs: fix uninit-value in squashfs_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025102814-CVE-2025-40049-1ce8@gregkh>
Date: Tue, 28 Oct 2025 12:48:26 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40049: Squashfs: fix uninit-value in squashfs_get_parent

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: fix uninit-value in squashfs_get_parent

Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.

This is caused by open_by_handle_at() being called with a file handle
containing an invalid parent inode number.  In particular the inode number
is that of a symbolic link, rather than a directory.

Squashfs_get_parent() gets called with that symbolic link inode, and
accesses the parent member field.

	unsigned int parent_ino = squashfs_i(inode)->parent;

Because non-directory inodes in Squashfs do not have a parent value, this
is uninitialised, and this causes an uninitialised value access.

The fix is to initialise parent with the invalid inode 0, which will cause
an EINVAL error to be returned.

Regular inodes used to share the parent field with the block_list_start
field.  This is removed in this commit to enable the parent field to
contain the invalid inode number 0.

The Linux kernel CVE team has assigned CVE-2025-40049 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.29 with commit 122601408d20c77704268f1dea9f9ce4abf997c2 and fixed in 5.15.195 with commit 61d38b5ce2782bff3cacaacbb8164087a73ed1a5
	Issue introduced in 2.6.29 with commit 122601408d20c77704268f1dea9f9ce4abf997c2 and fixed in 6.1.156 with commit 81a2bca52d43fc9d9abf07408b91255131c5dc53
	Issue introduced in 2.6.29 with commit 122601408d20c77704268f1dea9f9ce4abf997c2 and fixed in 6.6.112 with commit c28b0ca029edf5d0558abcd76cb8c732706cd339
	Issue introduced in 2.6.29 with commit 122601408d20c77704268f1dea9f9ce4abf997c2 and fixed in 6.12.53 with commit 1b3ccd0019132880c94bb00ca7088c1749308f82
	Issue introduced in 2.6.29 with commit 122601408d20c77704268f1dea9f9ce4abf997c2 and fixed in 6.17.3 with commit 91b99db7a92e57ff48a96a1b10fddfd2547e7f53
	Issue introduced in 2.6.29 with commit 122601408d20c77704268f1dea9f9ce4abf997c2 and fixed in 6.18-rc1 with commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40049
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/squashfs/inode.c
	fs/squashfs/squashfs_fs_i.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/61d38b5ce2782bff3cacaacbb8164087a73ed1a5
	https://git.kernel.org/stable/c/81a2bca52d43fc9d9abf07408b91255131c5dc53
	https://git.kernel.org/stable/c/c28b0ca029edf5d0558abcd76cb8c732706cd339
	https://git.kernel.org/stable/c/1b3ccd0019132880c94bb00ca7088c1749308f82
	https://git.kernel.org/stable/c/91b99db7a92e57ff48a96a1b10fddfd2547e7f53
	https://git.kernel.org/stable/c/74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf