In the Linux kernel, the following vulnerability has been resolved:
Squashfs: fix uninit-value in squashfsgetparent
Syzkaller reports a "KMSAN: uninit-value in squashfsgetparent" bug.
This is caused by openbyhandle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory.
Squashfsgetparent() gets called with that symbolic link inode, and accesses the parent member field.
unsigned int parent_ino = squashfs_i(inode)->parent;
Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access.
The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned.
Regular inodes used to share the parent field with the blockliststart field. This is removed in this commit to enable the parent field to contain the invalid inode number 0.
[
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/squashfs_fs_i.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28b0ca029edf5d0558abcd76cb8c732706cd339",
"digest": {
"line_hashes": [
"73172418186437683119487101432890620202",
"248344947014291045336765853510047916543",
"118632652260258686720859698961824150898",
"166096013162397028965397837306739178700",
"232800790859543564088215942796813921741",
"278152148983012229762013890747083336109",
"57164740519537454203846189158413510687",
"328885547507759694964729570652706152552"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-049c600e"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c",
"function": "squashfs_read_inode"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f81a5bc9e924ee1950e0dd82bd10749048390f6e",
"digest": {
"length": 8284.0,
"function_hash": "237359792417912079043415622115649354268"
},
"id": "CVE-2025-40049-247db0d2"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c",
"function": "squashfs_read_inode"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf",
"digest": {
"length": 8284.0,
"function_hash": "237359792417912079043415622115649354268"
},
"id": "CVE-2025-40049-4699cc96"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/squashfs_fs_i.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b3ccd0019132880c94bb00ca7088c1749308f82",
"digest": {
"line_hashes": [
"73172418186437683119487101432890620202",
"248344947014291045336765853510047916543",
"118632652260258686720859698961824150898",
"166096013162397028965397837306739178700",
"232800790859543564088215942796813921741",
"278152148983012229762013890747083336109",
"57164740519537454203846189158413510687",
"328885547507759694964729570652706152552"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-4e7d1ffd"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61d38b5ce2782bff3cacaacbb8164087a73ed1a5",
"digest": {
"line_hashes": [
"47313350234820979661232127972426410711",
"24280486522946579234351214774430830248",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"206552038478662438717628567730948476796",
"16301935442404400179107072179671668211",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"188760858623058078229764856929145315828",
"291050161675563188954063886517790840257",
"130446858886661982682120558619968730391",
"318788577926640313041431434986264188027",
"191175531068710424573877088971134334666",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"93733341371992760853282994340830756251",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"278863528970693006984105614845332374013",
"276005963827320052189808159400761639447",
"324509569805758074090398503122897887538",
"33824312178913255878865592927398900691",
"19506635876168826858485158368984525619",
"3609409578508842760258968193651845767",
"324509569805758074090398503122897887538",
"116763383676746353401060897542712491838"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-5868f51a"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf",
"digest": {
"line_hashes": [
"47313350234820979661232127972426410711",
"24280486522946579234351214774430830248",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"206552038478662438717628567730948476796",
"16301935442404400179107072179671668211",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"188760858623058078229764856929145315828",
"291050161675563188954063886517790840257",
"130446858886661982682120558619968730391",
"318788577926640313041431434986264188027",
"191175531068710424573877088971134334666",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"93733341371992760853282994340830756251",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"278863528970693006984105614845332374013",
"276005963827320052189808159400761639447",
"324509569805758074090398503122897887538",
"33824312178913255878865592927398900691",
"19506635876168826858485158368984525619",
"3609409578508842760258968193651845767",
"324509569805758074090398503122897887538",
"116763383676746353401060897542712491838"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-60432d41"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/squashfs_fs_i.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91b99db7a92e57ff48a96a1b10fddfd2547e7f53",
"digest": {
"line_hashes": [
"73172418186437683119487101432890620202",
"248344947014291045336765853510047916543",
"118632652260258686720859698961824150898",
"166096013162397028965397837306739178700",
"232800790859543564088215942796813921741",
"278152148983012229762013890747083336109",
"57164740519537454203846189158413510687",
"328885547507759694964729570652706152552"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-61f15ea9"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91b99db7a92e57ff48a96a1b10fddfd2547e7f53",
"digest": {
"line_hashes": [
"47313350234820979661232127972426410711",
"24280486522946579234351214774430830248",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"206552038478662438717628567730948476796",
"16301935442404400179107072179671668211",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"188760858623058078229764856929145315828",
"291050161675563188954063886517790840257",
"130446858886661982682120558619968730391",
"318788577926640313041431434986264188027",
"191175531068710424573877088971134334666",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"93733341371992760853282994340830756251",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"278863528970693006984105614845332374013",
"276005963827320052189808159400761639447",
"324509569805758074090398503122897887538",
"33824312178913255878865592927398900691",
"19506635876168826858485158368984525619",
"3609409578508842760258968193651845767",
"324509569805758074090398503122897887538",
"116763383676746353401060897542712491838"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-69b261a3"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@382a47fae449e554ef1e8c198667fd2f3270b945",
"digest": {
"line_hashes": [
"47313350234820979661232127972426410711",
"24280486522946579234351214774430830248",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"206552038478662438717628567730948476796",
"16301935442404400179107072179671668211",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"188760858623058078229764856929145315828",
"291050161675563188954063886517790840257",
"130446858886661982682120558619968730391",
"318788577926640313041431434986264188027",
"191175531068710424573877088971134334666",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"93733341371992760853282994340830756251",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"278863528970693006984105614845332374013",
"276005963827320052189808159400761639447",
"324509569805758074090398503122897887538",
"33824312178913255878865592927398900691",
"19506635876168826858485158368984525619",
"3609409578508842760258968193651845767",
"324509569805758074090398503122897887538",
"116763383676746353401060897542712491838"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-6afbb939"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c",
"function": "squashfs_read_inode"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28b0ca029edf5d0558abcd76cb8c732706cd339",
"digest": {
"length": 8284.0,
"function_hash": "237359792417912079043415622115649354268"
},
"id": "CVE-2025-40049-6e99688b"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/squashfs_fs_i.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf",
"digest": {
"line_hashes": [
"73172418186437683119487101432890620202",
"248344947014291045336765853510047916543",
"118632652260258686720859698961824150898",
"166096013162397028965397837306739178700",
"232800790859543564088215942796813921741",
"278152148983012229762013890747083336109",
"57164740519537454203846189158413510687",
"328885547507759694964729570652706152552"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-6ee42fe3"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f81a5bc9e924ee1950e0dd82bd10749048390f6e",
"digest": {
"line_hashes": [
"47313350234820979661232127972426410711",
"24280486522946579234351214774430830248",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"206552038478662438717628567730948476796",
"16301935442404400179107072179671668211",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"188760858623058078229764856929145315828",
"291050161675563188954063886517790840257",
"130446858886661982682120558619968730391",
"318788577926640313041431434986264188027",
"191175531068710424573877088971134334666",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"93733341371992760853282994340830756251",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"278863528970693006984105614845332374013",
"276005963827320052189808159400761639447",
"324509569805758074090398503122897887538",
"33824312178913255878865592927398900691",
"19506635876168826858485158368984525619",
"3609409578508842760258968193651845767",
"324509569805758074090398503122897887538",
"116763383676746353401060897542712491838"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-750287d8"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c",
"function": "squashfs_read_inode"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61d38b5ce2782bff3cacaacbb8164087a73ed1a5",
"digest": {
"length": 8284.0,
"function_hash": "237359792417912079043415622115649354268"
},
"id": "CVE-2025-40049-974b6aac"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/squashfs_fs_i.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@382a47fae449e554ef1e8c198667fd2f3270b945",
"digest": {
"line_hashes": [
"73172418186437683119487101432890620202",
"248344947014291045336765853510047916543",
"118632652260258686720859698961824150898",
"166096013162397028965397837306739178700",
"232800790859543564088215942796813921741",
"278152148983012229762013890747083336109",
"57164740519537454203846189158413510687",
"328885547507759694964729570652706152552"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-b9cd56a3"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81a2bca52d43fc9d9abf07408b91255131c5dc53",
"digest": {
"line_hashes": [
"47313350234820979661232127972426410711",
"24280486522946579234351214774430830248",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"206552038478662438717628567730948476796",
"16301935442404400179107072179671668211",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"188760858623058078229764856929145315828",
"291050161675563188954063886517790840257",
"130446858886661982682120558619968730391",
"318788577926640313041431434986264188027",
"191175531068710424573877088971134334666",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"93733341371992760853282994340830756251",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"278863528970693006984105614845332374013",
"276005963827320052189808159400761639447",
"324509569805758074090398503122897887538",
"33824312178913255878865592927398900691",
"19506635876168826858485158368984525619",
"3609409578508842760258968193651845767",
"324509569805758074090398503122897887538",
"116763383676746353401060897542712491838"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-c096912e"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/squashfs_fs_i.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61d38b5ce2782bff3cacaacbb8164087a73ed1a5",
"digest": {
"line_hashes": [
"73172418186437683119487101432890620202",
"248344947014291045336765853510047916543",
"118632652260258686720859698961824150898",
"166096013162397028965397837306739178700",
"232800790859543564088215942796813921741",
"278152148983012229762013890747083336109",
"57164740519537454203846189158413510687",
"328885547507759694964729570652706152552"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-c1fae2ce"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c",
"function": "squashfs_read_inode"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91b99db7a92e57ff48a96a1b10fddfd2547e7f53",
"digest": {
"length": 8284.0,
"function_hash": "237359792417912079043415622115649354268"
},
"id": "CVE-2025-40049-c5a31fc6"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c",
"function": "squashfs_read_inode"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81a2bca52d43fc9d9abf07408b91255131c5dc53",
"digest": {
"length": 8284.0,
"function_hash": "237359792417912079043415622115649354268"
},
"id": "CVE-2025-40049-ce50ee1d"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c",
"function": "squashfs_read_inode"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b3ccd0019132880c94bb00ca7088c1749308f82",
"digest": {
"length": 8284.0,
"function_hash": "237359792417912079043415622115649354268"
},
"id": "CVE-2025-40049-d95b23fc"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/squashfs_fs_i.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81a2bca52d43fc9d9abf07408b91255131c5dc53",
"digest": {
"line_hashes": [
"73172418186437683119487101432890620202",
"248344947014291045336765853510047916543",
"118632652260258686720859698961824150898",
"166096013162397028965397837306739178700",
"232800790859543564088215942796813921741",
"278152148983012229762013890747083336109",
"57164740519537454203846189158413510687",
"328885547507759694964729570652706152552"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-e0f12e3b"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/squashfs_fs_i.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f81a5bc9e924ee1950e0dd82bd10749048390f6e",
"digest": {
"line_hashes": [
"73172418186437683119487101432890620202",
"248344947014291045336765853510047916543",
"118632652260258686720859698961824150898",
"166096013162397028965397837306739178700",
"232800790859543564088215942796813921741",
"278152148983012229762013890747083336109",
"57164740519537454203846189158413510687",
"328885547507759694964729570652706152552"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-e40a16ab"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b3ccd0019132880c94bb00ca7088c1749308f82",
"digest": {
"line_hashes": [
"47313350234820979661232127972426410711",
"24280486522946579234351214774430830248",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"206552038478662438717628567730948476796",
"16301935442404400179107072179671668211",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"188760858623058078229764856929145315828",
"291050161675563188954063886517790840257",
"130446858886661982682120558619968730391",
"318788577926640313041431434986264188027",
"191175531068710424573877088971134334666",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"93733341371992760853282994340830756251",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"278863528970693006984105614845332374013",
"276005963827320052189808159400761639447",
"324509569805758074090398503122897887538",
"33824312178913255878865592927398900691",
"19506635876168826858485158368984525619",
"3609409578508842760258968193651845767",
"324509569805758074090398503122897887538",
"116763383676746353401060897542712491838"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-ea8ed321"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28b0ca029edf5d0558abcd76cb8c732706cd339",
"digest": {
"line_hashes": [
"47313350234820979661232127972426410711",
"24280486522946579234351214774430830248",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"206552038478662438717628567730948476796",
"16301935442404400179107072179671668211",
"175382661969694351526233645142619625095",
"152122657109268246012110604177987108397",
"188760858623058078229764856929145315828",
"291050161675563188954063886517790840257",
"130446858886661982682120558619968730391",
"318788577926640313041431434986264188027",
"191175531068710424573877088971134334666",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"93733341371992760853282994340830756251",
"145867695474523950968401992790822810878",
"119067259737864067309309256997439170428",
"2258938155582376444605870330848244300",
"278863528970693006984105614845332374013",
"276005963827320052189808159400761639447",
"324509569805758074090398503122897887538",
"33824312178913255878865592927398900691",
"19506635876168826858485158368984525619",
"3609409578508842760258968193651845767",
"324509569805758074090398503122897887538",
"116763383676746353401060897542712491838"
],
"threshold": 0.9
},
"id": "CVE-2025-40049-f930602e"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/squashfs/inode.c",
"function": "squashfs_read_inode"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@382a47fae449e554ef1e8c198667fd2f3270b945",
"digest": {
"length": 8284.0,
"function_hash": "237359792417912079043415622115649354268"
},
"id": "CVE-2025-40049-fd759a0e"
}
]