ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-40306

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix xattr related buffer overflow...

Published Dec 8, 2025 · catalog updated Oct 14, 2026 · In the Linux kernel,

Check if you run it

No confirmed exploitation is on record for CVE-2025-40306. EPSS is 0.16%. Act only if a listed version of In the Linux kernel, is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (In the Linux kernel,).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.16%
Remediation
Not established
Affected products
See sources for product scope

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix xattr related buffer overflow... Willy Tarreau forwarded me a message from Disclosure with the following warning: > The helper uses the pointer variable in the loop condition > rather than dereferencing it. As is incremented, it remains non-NULL > (until it runs into unmapped memory), so the loop does not terminate on > valid C strings and will walk memory indefinitely, consuming CPU or hanging > the thread. I easily reproduced this with setfattr and getfattr, causing a kernel oops, hung user processes and corrupted orangefs files. Disclosure sent along a diff (not a patch) with a suggested fix, which I based this patch on. After xattr_key started working right, xfstest generic/069 exposed an xattr related memory leak that lead to OOM. xattr_key returns a hashed key. When adding xattrs to the orangefs xattr cache, orangefs used hash_add, a kernel hashing macro. hash_add also hashes the key using hash_log which resulted in additions to the xattr cache going to the wrong hash bucket. generic/069 tortures a single file and orangefs does a getattr for the xattr "security.capability" every time. Orangefs negative caches on xattrs which includes a kmalloc. Since adds to the xattr cache were going to the wrong bucket, every getattr for "security.capability" resulted in another kmalloc, none of which were ever freed. I changed the two uses of hash_add to hlist_add_head instead and the memory leak ceased and generic/069 quit throwing furniture.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2025-40306

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2025-40306. EPSS is 0.16%. Act only if a listed version of In the Linux kernel, is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.16%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 8, 2025 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: orangefs: fix xattr related buffer overflow... Willy Tarreau forwarded me a message from Disclosure with the following warning: > The helper uses the pointer variable in the loop condition > rather than dereferencing it. As is incremented, it remains non-NULL > (until it runs into unmapped memory), so the loop does not terminate o

  2. Oct 14, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: orangefs: fix xattr related buffer overflow... Willy Tarreau forwarded me a message from Disclosure with the following warning: > The helper uses the pointer variable in the loop condition > rather than dereferencing it. As is incremented, it remains non-NULL > (until it runs into unmapped memory), so the loop does not terminate o

Sources

  • CVE.orgVulnerability recordCVE-2025-40306

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-40306

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2025-40306

    In the Linux kernel, the following vulnerability has been resolved: orangefs: fix xattr related buffer overflow... Willy Tarreau forwarded me a message from Disclosure with the following warning: > The helper uses the pointer var

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.