CVE-2025-40198

ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()

State: Published
Severity: 7.8 High
Published: Nov 12, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()

Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden parse_apply_sb_mount_options() by treating s_mount_opts as a potential __nonstring.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before 7bf46ff83a0ef11836e38ebd72cdc5107209342dAffected 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before b2bac84fde28fb6a88817b8b761abda17a1d300bAffected 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before e651294218d2684302ee5ed95ccf381646f3e5b4Affected 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before 01829af7656b56d83682b3491265d583d502e502Affected 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before 2a0cf438320cdb783e0378570744c0ef0d83e934Affected 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before a6e94557cd05adc82fae0400f6e17745563e5412Affected 8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before 8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8Affected
LinuxLinux	2.6.36Affected before 2.6.36Not affected 5.4.301 through 5.4.Not affected 5.10.246 through 5.10.Not affected 6.1.158 through 6.1.Not affected 6.6.114 through 6.6.Not affected 6.12.54 through 6.12.Not affected 6.17.4 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before 7bf46ff83a0ef11836e38ebd72cdc5107209342dAffected
8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before b2bac84fde28fb6a88817b8b761abda17a1d300bAffected
8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before e651294218d2684302ee5ed95ccf381646f3e5b4Affected
8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before 01829af7656b56d83682b3491265d583d502e502Affected
8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before 2a0cf438320cdb783e0378570744c0ef0d83e934Affected
8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before a6e94557cd05adc82fae0400f6e17745563e5412Affected
8b67f04ab9de5d8f3a71aef72bf02c995a506db5 to before 8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8Affected

LinuxLinux

2.6.36Affected
before 2.6.36Not affected
5.4.301 through 5.4.*Not affected
5.10.246 through 5.10.*Not affected
6.1.158 through 6.1.*Not affected
6.6.114 through 6.6.*Not affected
6.12.54 through 6.12.*Not affected
6.17.4 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.