PT-2025-46603 · Btrfs+1 · Btrfs+1

Published 2025-11-12 · Updated 2025-11-12 · CVE-2025-40128

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc4-custom+ #283

Description The Linux kernel contains a flaw related to handling symbolic links when the block size is larger than the page size (bs > ps) within the Btrfs filesystem. Specifically, the issue arises from incorrect folio order handling for newly created inodes, leading to a kernel BUG when attempting to read symbolic links. The root cause is the conditional setting of inode mapping order within btrfs create new inode(), which doesn't account for symbolic links properly. The fix involves unconditionally calling btrfs set inode mapping order() within btrfs create new inode(). This ensures correct folio order for symbolic links, preventing the crash, while having no impact on regular files or other inode types.

Recommendations Update to a version later than 6.17.0-rc4-custom+ #283.

Related Identifiers

CVE-2025-40128

Affected Products

Btrfs

Linux Kernel

References · 10

• https://osv.dev/vulnerability/CVE-2025-40128 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40128 · Security Note
• https://ubuntu.com/security/CVE-2025-40128 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40128 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40128 · Vendor Advisory
• https://git.kernel.org/stable/c/67378b754608a3524d125bfa5744508a49fe48be · Note
• https://git.kernel.org/stable/c/3ea252a5c48dd3a4e1f7d0c53d3b0f7b648becc9 · Note
• https://twitter.com/CVEnew/status/1988721771659272534 · Twitter Post
• https://git.kernel.org/linus/67378b754608a3524d125bfa5744508a49fe48be · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note