CVE-2025-40049

Root

Cause

CVE-2025-40049 describes an uninitialized value in the Linux kernel's Squashfs filesystem driver, specifically in the squashfs_get_parent function. The bug is triggered when open_by_handle_at() is called with a file handle containing an invalid parent inode number—for example, the inode of a symbolic link instead of a directory. Because non-directory inodes in Squashfs do not have a parent field, reading squashfs_i(inode)->parent returns uninitialized data, which causes an uninitialized value access.

Exploitation

An attacker who can craft a file handle with a symbolic link inode and pass it to open_by_handle_at() can trigger this vulnerability. No special privileges beyond the ability to create such file handles are required. The attack surface is local, as it relies on access to the kernel's file handle system calls.

Impact

Accessing the uninitialized parent member can lead to unpredictable behavior, including kernel memory disclosure or crashes. The original Syzkaller report classifies this as a KMSAN (Kernel Memory Sanitizer) uninit-value bug, indicating potential information leakage or instability.

Mitigation

The fix, already applied to the stable kernel tree [1], initializes the parent field to the invalid inode number 0 (an invalid inode), causing squashfs_get_parent to return -EINVAL when encountering a non-directory inode. This prevents the uninitialized read and safely. The commit also removes a shared union between the parent and block_list_start field for regular inodes so that the parent field can reliably hold a zero value. Users should update their kernel to a version containing the corresponding commit (e.g., 81a2bca52d43) [1]. No known workaround exists other than applying the patch.