PT-2025-44117 · Linux +1 · Linux Kernel +1

Published 2025-10-28 · Updated 2025-10-29 · CVE-2025-40049

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the Squashfs file system related to uninitialized values in the

squashfs get parent

function. This issue arises when

open by handle at()

is invoked with a file handle containing an invalid parent inode number, specifically that of a symbolic link instead of a directory. The

squashfs get parent()

function then accesses the uninitialized parent member field, leading to a potential error. The fix involves initializing the parent field with the invalid inode number 0, which will return an EINVAL error. Previously, inodes shared the parent field with the

block list start

field, which has been removed to allow the parent field to contain the invalid inode number 0.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-40049

Affected Products

Linux Kernel

Squashfs

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-40049 · Security Note
• https://git.kernel.org/stable/c/61d38b5ce2782bff3cacaacbb8164087a73ed1a5 · Note
• https://git.kernel.org/stable/c/f81a5bc9e924ee1950e0dd82bd10749048390f6e · Note
• https://git.kernel.org/stable/c/81a2bca52d43fc9d9abf07408b91255131c5dc53 · Note
• https://git.kernel.org/stable/c/91b99db7a92e57ff48a96a1b10fddfd2547e7f53 · Note
• https://git.kernel.org/stable/c/1b3ccd0019132880c94bb00ca7088c1749308f82 · Note
• https://git.kernel.org/stable/c/c28b0ca029edf5d0558abcd76cb8c732706cd339 · Note
• https://t.me/msrcreports/2226 · Telegram Post
• https://git.kernel.org/stable/c/382a47fae449e554ef1e8c198667fd2f3270b945 · Note
• https://git.kernel.org/stable/c/74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf · Note
• https://twitter.com/CVEnew/status/1983149470012580004 · Twitter Post