CVE-2025-40205btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
- 7.8HighCVSS base score
- 0.15%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNECTABLE (5 dwords, 20 bytes) or BTRFS_FID_SIZE_CONNECTABLE (8 dwords, 32 bytes). However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (10 dwords, 40 bytes). If *max_len is not large enough, this write goes out of bounds because BTRFS_FID_SIZE_CONNECTABLE_ROOT is greater than BTRFS_FID_SIZE_CONNECTABLE originally returned. This results in an 8-byte out-of-bounds write at fid->parent_root_objectid = parent_root_id. A previous attempt to fix this issue was made but was lost. https://lore.kernel.org/all/[email protected]/ Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data.
Timeline
ID reserved
By Linux
- 7 months later
· 7 months later
Published
- 11 months later
· 11 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.15% · top 95% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected be6e8dc0ba84029997075a1ec77b4ddb863cbe15 – < 60de2f55d2aca53e81b4ef2a67d7cc9e1eb677db
- affected be6e8dc0ba84029997075a1ec77b4ddb863cbe15 – < 742b44342204e5dfe3926433823623c1a0c581df
- affected be6e8dc0ba84029997075a1ec77b4ddb863cbe15 – < d3a9a8e1275eb9b87f006b5562a287aea3f6885f
- affected be6e8dc0ba84029997075a1ec77b4ddb863cbe15 – < d91f6626133698362bba08fbc04bd72c466806d3
- affected be6e8dc0ba84029997075a1ec77b4ddb863cbe15 – < 0276c8582488022f057b4cec21975a5edf079f47
- affected be6e8dc0ba84029997075a1ec77b4ddb863cbe15 – < 361d67276eb8ec6be8f27f4ad6c6090459438fee
- affected be6e8dc0ba84029997075a1ec77b4ddb863cbe15 – < 43143776b0a7604d873d1a6f3e552a00aa930224
- affected be6e8dc0ba84029997075a1ec77b4ddb863cbe15 – < dff4f9ff5d7f289e4545cc936362e01ed3252742
- affected 2.6.29
- unaffected < 2.6.29
- unaffected 5.4.301 – ≤ 5.4.*
- unaffected 5.10.246 – ≤ 5.10.*
- unaffected 5.15.195 – ≤ 5.15.*
- unaffected 6.1.157 – ≤ 6.1.*
- unaffected 6.6.113 – ≤ 6.6.*
- unaffected 6.12.54 – ≤ 6.12.*
- unaffected 6.17.4 – ≤ 6.17.*
- unaffected 6.18 – ≤ *
References
References8
- https://git.kernel.org/stable/c/60de2f55d2aca53e81b4ef2a67d7cc9e1eb677db (opens in a new tab)
- https://git.kernel.org/stable/c/742b44342204e5dfe3926433823623c1a0c581df (opens in a new tab)
- https://git.kernel.org/stable/c/d3a9a8e1275eb9b87f006b5562a287aea3f6885f (opens in a new tab)
- https://git.kernel.org/stable/c/d91f6626133698362bba08fbc04bd72c466806d3 (opens in a new tab)
- https://git.kernel.org/stable/c/0276c8582488022f057b4cec21975a5edf079f47 (opens in a new tab)
- https://git.kernel.org/stable/c/361d67276eb8ec6be8f27f4ad6c6090459438fee (opens in a new tab)
- https://git.kernel.org/stable/c/43143776b0a7604d873d1a6f3e552a00aa930224 (opens in a new tab)
- https://git.kernel.org/stable/c/dff4f9ff5d7f289e4545cc936362e01ed3252742 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-150369 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-40205)Record last updated .