Bug 2406771 (CVE-2025-40049)

Summary:	CVE-2025-40049 kernel: Squashfs: fix uninit-value in squashfs_get_parent
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Squashfs filesystem driver. In squashfs_get_parent(), when open_by_handle_at() is called with a file handle containing an inode number of a symbolic link (rather than a directory), the function accesses the uninitialized parent member field. Non-directory inodes in Squashfs do not have a parent value, leading to an uninitialized value access. This could result in unpredictable behavior or information disclosure from kernel memory. A local user with the ability to mount Squashfs filesystems or use file handle operations could trigger this condition.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-10-28 12:04:37 UTC

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: fix uninit-value in squashfs_get_parent

Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.

This is caused by open_by_handle_at() being called with a file handle
containing an invalid parent inode number.  In particular the inode number
is that of a symbolic link, rather than a directory.

Squashfs_get_parent() gets called with that symbolic link inode, and
accesses the parent member field.

	unsigned int parent_ino = squashfs_i(inode)->parent;

Because non-directory inodes in Squashfs do not have a parent value, this
is uninitialised, and this causes an uninitialised value access.

The fix is to initialise parent with the invalid inode 0, which will cause
an EINVAL error to be returned.

Regular inodes used to share the parent field with the block_list_start
field.  This is removed in this commit to enable the parent field to
contain the invalid inode number 0.

Comment 1 Jon Moroney 2025-10-28 20:46:54 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025102814-CVE-2025-40049-1ce8@gregkh/T