CVE-2025-40200

Summary

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: reject negative file sizes in squashfs_read_inode()

Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.

This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size.

This commit checks for a negative file size and returns EINVAL.

[phillip@squashfs.org.uk: only need to check 64 bit quantity]

Affected Software

VendorProductVersion RangeStatus
LinuxLinux6545b246a2c815a8fcd07d58240effb6ec3481b1 < 54170057a5fadd24a37b70de41e61d39284d9bd7affected
LinuxLinux6545b246a2c815a8fcd07d58240effb6ec3481b1 < 2871c74caa3f4f05b429e6bfefebac62dbf1b408affected
LinuxLinux6545b246a2c815a8fcd07d58240effb6ec3481b1 < fbfc745db628de31f5c089147deeb87e95b89e66affected
LinuxLinux6545b246a2c815a8fcd07d58240effb6ec3481b1 < 8118f66124895829443d09c207e654adcb2f9321affected
LinuxLinux6545b246a2c815a8fcd07d58240effb6ec3481b1 < 8c7aad76751816207fee556d44aa88a710824810affected
LinuxLinux6545b246a2c815a8fcd07d58240effb6ec3481b1 < 875fb3f87ae0225b881319ba016a1a8c4ffd5812affected
LinuxLinux6545b246a2c815a8fcd07d58240effb6ec3481b1 < f271155ff31aca8ef82c61c8df23ca97e9a77dd4affected
LinuxLinux6545b246a2c815a8fcd07d58240effb6ec3481b1 < 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2baffected
LinuxLinux2.6.29affected
LinuxLinux0 < 2.6.29unaffected
LinuxLinux5.4.301 <= 5.4.*unaffected
LinuxLinux5.10.246 <= 5.10.*unaffected
LinuxLinux5.15.195 <= 5.15.*unaffected
LinuxLinux6.1.157 <= 6.1.*unaffected
LinuxLinux6.6.113 <= 6.6.*unaffected
LinuxLinux6.12.54 <= 6.12.*unaffected
LinuxLinux6.17.4 <= 6.17.*unaffected
LinuxLinux6.18 <= *unaffected

Weaknesses

References