CVE-2025-40246
Description
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix out of bounds memory read error in symlink repair
xfs/286 produced this report on my test fleet:
================================================================== BUG: KFENCE: out-of-bounds read in memcpy_orig+0x54/0x110
Out-of-bounds read at 0xffff88843fe9e038 (184B right of kfence-#184): memcpy_orig+0x54/0x110 xrep_symlink_salvage_inline+0xb3/0xf0 [xfs] xrep_symlink_salvage+0x100/0x110 [xfs] xrep_symlink+0x2e/0x80 [xfs] xrep_attempt+0x61/0x1f0 [xfs] xfs_scrub_metadata+0x34f/0x5c0 [xfs] xfs_ioc_scrubv_metadata+0x387/0x560 [xfs] xfs_file_ioctl+0xe23/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
kfence-#184: 0xffff88843fe9df80-0xffff88843fe9dfea, size=107, cache=kmalloc-128
allocated by task 3470 on cpu 1 at 263329.131592s (192823.508886s ago): xfs_init_local_fork+0x79/0xe0 [xfs] xfs_iformat_local+0xa4/0x170 [xfs] xfs_iformat_data_fork+0x148/0x180 [xfs] xfs_inode_from_disk+0x2cd/0x480 [xfs] xfs_iget+0x450/0xd60 [xfs] xfs_bulkstat_one_int+0x6b/0x510 [xfs] xfs_bulkstat_iwalk+0x1e/0x30 [xfs] xfs_iwalk_ag_recs+0xdf/0x150 [xfs] xfs_iwalk_run_callbacks+0xb9/0x190 [xfs] xfs_iwalk_ag+0x1dc/0x2f0 [xfs] xfs_iwalk_args.constprop.0+0x6a/0x120 [xfs] xfs_iwalk+0xa4/0xd0 [xfs] xfs_bulkstat+0xfa/0x170 [xfs] xfs_ioc_fsbulkstat.isra.0+0x13a/0x230 [xfs] xfs_file_ioctl+0xbf2/0x10e0 [xfs] __x64_sys_ioctl+0x76/0xc0 do_syscall_64+0x4e/0x1e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
CPU: 1 UID: 0 PID: 1300113 Comm: xfs_scrub Not tainted 6.18.0-rc4-djwx #rc4 PREEMPT(lazy) 3d744dd94e92690f00a04398d2bd8631dcef1954 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-4.module+el8.8.0+21164+ed375313 04/01/2014 ==================================================================
On further analysis, I realized that the second parameter to min() is not correct. xfs_ifork::if_bytes is the size of the xfs_ifork::if_data buffer. if_bytes can be smaller than the data fork size because:
(a) the forkoff code tries to keep the data area as large as possible (b) for symbolic links, if_bytes is the ondisk file size + 1 (c) forkoff is always a multiple of 8.
Case in point: for a single-byte symlink target, forkoff will be 8 but the buffer will only be 2 bytes long.
In other words, the logic here is wrong and we walk off the end of the incore buffer. Fix that.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An out-of-bounds memory read in XFS symlink repair (xrep_symlink_salvage_inline) occurs due to an incorrect min() parameter referencing if_bytes instead of the data length.
Vulnerability
The vulnerability resides in the Linux kernel's XFS filesystem repair code, specifically in xrep_symlink_salvage_inline. The symlink repair function uses min() to determine the size of a memory copy operation, but passes xfs_ifork::if_bytes as the second argument instead of the actual symlink data length. if_bytes is the size of the buffer (if_data), not the valid data within it, leading to a potential out-of-bounds read when the buffer is partially filled [1] [2].
Exploitation
An attacker would need to trigger an online filesystem repair (xfs_scrub) on a crafted XFS filesystem containing an inode with a local symlink fork that has a valid data length smaller than the allocated buffer. The repair operation calls xrep_symlink_salvage, which invokes the inline salvage function. The kfence report shows the out-of-bounds read occurs during memcpy_orig at offset 0xffff88843fe9e038, 184 bytes beyond a 107-byte allocated object [1].
Impact
The out-of-bounds read can cause a kernel crash or information disclosure if the read accesses sensitive kernel memory. The report was triggered by xfs_scrub running with root privileges, so successful exploitation requires elevated privileges to invoke the scrub ioctl on a malicious filesystem. The bug is classified as a memory safety issue with potential for denial of service [1] [2].
Mitigation
The fix is available in the Linux kernel stable branch. Patches have been applied to correct the min() parameter to use the symlink target length instead of if_bytes [1] [2]. Sysadmins should apply the latest kernel updates promptly. No workarounds are available other than avoiding the repair operation on untrusted filesystems.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
37c2d68e0915881a8685cac4b678e1cc2f482Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.