CVE-2025-40200

Squashfs: reject negative file sizes in squashfs_read_inode()

State: Published
Severity: Not scored
Published: Nov 12, 2025
Updated: May 11, 2026
Reserved: Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: reject negative file sizes in squashfs_read_inode()

Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.

This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size.

This commit checks for a negative file size and returns EINVAL.

[phillip@squashfs.org.uk: only need to check 64 bit quantity]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 54170057a5fadd24a37b70de41e61d39284d9bd7Affected 6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 2871c74caa3f4f05b429e6bfefebac62dbf1b408Affected 6545b246a2c815a8fcd07d58240effb6ec3481b1 to before fbfc745db628de31f5c089147deeb87e95b89e66Affected 6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 8118f66124895829443d09c207e654adcb2f9321Affected 6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 8c7aad76751816207fee556d44aa88a710824810Affected 6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 875fb3f87ae0225b881319ba016a1a8c4ffd5812Affected 6545b246a2c815a8fcd07d58240effb6ec3481b1 to before f271155ff31aca8ef82c61c8df23ca97e9a77dd4Affected 6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2bAffected
LinuxLinux	2.6.29Affected before 2.6.29Not affected 5.4.301 through 5.4.Not affected 5.10.246 through 5.10.Not affected 5.15.195 through 5.15.Not affected 6.1.157 through 6.1.Not affected 6.6.113 through 6.6.Not affected 6.12.54 through 6.12.Not affected 6.17.4 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 54170057a5fadd24a37b70de41e61d39284d9bd7Affected
6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 2871c74caa3f4f05b429e6bfefebac62dbf1b408Affected
6545b246a2c815a8fcd07d58240effb6ec3481b1 to before fbfc745db628de31f5c089147deeb87e95b89e66Affected
6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 8118f66124895829443d09c207e654adcb2f9321Affected
6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 8c7aad76751816207fee556d44aa88a710824810Affected
6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 875fb3f87ae0225b881319ba016a1a8c4ffd5812Affected
6545b246a2c815a8fcd07d58240effb6ec3481b1 to before f271155ff31aca8ef82c61c8df23ca97e9a77dd4Affected
6545b246a2c815a8fcd07d58240effb6ec3481b1 to before 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2bAffected

LinuxLinux

2.6.29Affected
before 2.6.29Not affected
5.4.301 through 5.4.*Not affected
5.10.246 through 5.10.*Not affected
5.15.195 through 5.15.*Not affected
6.1.157 through 6.1.*Not affected
6.6.113 through 6.6.*Not affected
6.12.54 through 6.12.*Not affected
6.17.4 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.