CVE-2025-40044— fs: udf: fix OOB read in lengthAllocDescs handling
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-40044
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
fs: udf: fix OOB read in lengthAllocDescs handling
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set lengthAllocDescs so that the total descriptor length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer, leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and trigger a KASAN use-after-free read. BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309 CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106 udf_release_file+0xc1/0x120 fs/udf/file.c:185 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Validate the computed total length against epos->bh->b_size. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未验证lengthAllocDescs参数，可能导致越界读取和释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-40044
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-40044
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-10-28 · 58 CVEs total
| CVE-2025-40064 | smc: Fix use-after-free in __pnet_find_base_ndev(). | |
| CVE-2025-40075 | tcp_metrics: use dst_dev_net_rcu() | |
| CVE-2025-40078 | bpf: Explicitly check accesses to bpf_sock_addr | |
| CVE-2025-40079 | riscv, bpf: Sign extend struct ops return values properly | |
| CVE-2025-40077 | f2fs: fix to avoid overflow while left shift operation | |
| CVE-2025-40081 | perf: arm_spe: Prevent overflow in PERF_IDX2OFF() | |
| CVE-2025-40068 | fs: ntfs3: Fix integer overflow in run_unpack() | |
| CVE-2025-40067 | fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist | |
| CVE-2025-40066 | wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links() | |
| CVE-2025-40065 | RISC-V: KVM: Write hgatp register with valid mode bits | |
| CVE-2025-40069 | drm/msm: Fix obj leak in VM_BIND error path | |
| CVE-2025-40063 | crypto: comp - Use same definition of context alloc and free ops | |
| CVE-2025-40062 | crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs | |
| CVE-2025-40061 | RDMA/rxe: Fix race in do_task() when draining | |
| CVE-2025-40060 | coresight: trbe: Return NULL pointer for allocation failures | |
| CVE-2025-40058 | iommu/vt-d: Disallow dirty tracking if incoherent page walk | |
| CVE-2025-40059 | coresight: Fix incorrect handling for return value of devm_kzalloc | |
| CVE-2025-40057 | ptp: Add a upper bound on max_vclocks | |
| CVE-2025-40056 | vhost: vringh: Fix copy_to_iter return value check | |
| CVE-2025-40055 | ocfs2: fix double free in user_cluster_connect() |
Showing top 20 of 58 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2025-40044
No comments yet