In the Linux kernel, the following vulnerability has been resolved:
btrfs: avoid potential out-of-bounds in btrfsencodefh()
The function btrfsencodefh() does not properly account for the three cases it handles.
Before writing to the file handle (fh), the function only returns to the user BTRFSFIDSIZENONCONNECTABLE (5 dwords, 20 bytes) or BTRFSFIDSIZE_CONNECTABLE (8 dwords, 32 bytes).
However, when a parent exists and the root ID of the parent and the inode are different, the function writes BTRFSFIDSIZECONNECTABLEROOT (10 dwords, 40 bytes).
If *maxlen is not large enough, this write goes out of bounds because BTRFSFIDSIZECONNECTABLEROOT is greater than BTRFSFIDSIZECONNECTABLE originally returned.
This results in an 8-byte out-of-bounds write at fid->parentrootobjectid = parentrootid.
A previous attempt to fix this issue was made but was lost.
https://lore.kernel.org/all/4CADAEEC020000780001B32C@vpn.id2.novell.com/
Although this issue does not seem to be easily triggerable, it is a potential memory corruption bug that should be fixed. This patch resolves the issue by ensuring the function returns the appropriate size for all three cases and validates that *max_len is large enough before writing any data.
[
{
"id": "CVE-2025-40205-129e867b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91f6626133698362bba08fbc04bd72c466806d3",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244086189841155794775821733469362646947",
"323790943427362853413510485137196649678",
"72567552527598107664382487881119419580",
"324978786881442177104412408728881900717",
"81542072440905285463568174195160233386",
"120216507296114006420648606231307237713",
"16980727216413262672280913670460181827",
"264096260683090031823464152738203644723"
]
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c"
}
},
{
"id": "CVE-2025-40205-225f501c",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91f6626133698362bba08fbc04bd72c466806d3",
"signature_type": "Function",
"digest": {
"function_hash": "107632473168057763558308181074389386107",
"length": 1097.0
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c",
"function": "btrfs_encode_fh"
}
},
{
"id": "CVE-2025-40205-303302f4",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dff4f9ff5d7f289e4545cc936362e01ed3252742",
"signature_type": "Function",
"digest": {
"function_hash": "157569384724570256683406721469193893016",
"length": 1067.0
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c",
"function": "btrfs_encode_fh"
}
},
{
"id": "CVE-2025-40205-39e5b89b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0276c8582488022f057b4cec21975a5edf079f47",
"signature_type": "Function",
"digest": {
"function_hash": "107632473168057763558308181074389386107",
"length": 1097.0
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c",
"function": "btrfs_encode_fh"
}
},
{
"id": "CVE-2025-40205-48d69751",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3a9a8e1275eb9b87f006b5562a287aea3f6885f",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244086189841155794775821733469362646947",
"323790943427362853413510485137196649678",
"72567552527598107664382487881119419580",
"324978786881442177104412408728881900717",
"81542072440905285463568174195160233386",
"120216507296114006420648606231307237713",
"16980727216413262672280913670460181827",
"264096260683090031823464152738203644723"
]
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c"
}
},
{
"id": "CVE-2025-40205-5f7c9a3d",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dff4f9ff5d7f289e4545cc936362e01ed3252742",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244086189841155794775821733469362646947",
"323790943427362853413510485137196649678",
"72567552527598107664382487881119419580",
"324978786881442177104412408728881900717",
"122390478762134762209548579169387038123",
"81691120799006043614730609383698135085",
"77511811599334764385655136544236253099",
"264096260683090031823464152738203644723"
]
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c"
}
},
{
"id": "CVE-2025-40205-718908b1",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@361d67276eb8ec6be8f27f4ad6c6090459438fee",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244086189841155794775821733469362646947",
"323790943427362853413510485137196649678",
"72567552527598107664382487881119419580",
"324978786881442177104412408728881900717",
"122390478762134762209548579169387038123",
"81691120799006043614730609383698135085",
"77511811599334764385655136544236253099",
"264096260683090031823464152738203644723"
]
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c"
}
},
{
"id": "CVE-2025-40205-72a66cee",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60de2f55d2aca53e81b4ef2a67d7cc9e1eb677db",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244086189841155794775821733469362646947",
"323790943427362853413510485137196649678",
"72567552527598107664382487881119419580",
"324978786881442177104412408728881900717",
"81542072440905285463568174195160233386",
"120216507296114006420648606231307237713",
"16980727216413262672280913670460181827",
"264096260683090031823464152738203644723"
]
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c"
}
},
{
"id": "CVE-2025-40205-9d5a19f1",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0276c8582488022f057b4cec21975a5edf079f47",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244086189841155794775821733469362646947",
"323790943427362853413510485137196649678",
"72567552527598107664382487881119419580",
"324978786881442177104412408728881900717",
"81542072440905285463568174195160233386",
"120216507296114006420648606231307237713",
"16980727216413262672280913670460181827",
"264096260683090031823464152738203644723"
]
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c"
}
},
{
"id": "CVE-2025-40205-a18a1e70",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@361d67276eb8ec6be8f27f4ad6c6090459438fee",
"signature_type": "Function",
"digest": {
"function_hash": "157569384724570256683406721469193893016",
"length": 1067.0
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c",
"function": "btrfs_encode_fh"
}
},
{
"id": "CVE-2025-40205-a831e89d",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43143776b0a7604d873d1a6f3e552a00aa930224",
"signature_type": "Function",
"digest": {
"function_hash": "157569384724570256683406721469193893016",
"length": 1067.0
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c",
"function": "btrfs_encode_fh"
}
},
{
"id": "CVE-2025-40205-ac1ac177",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60de2f55d2aca53e81b4ef2a67d7cc9e1eb677db",
"signature_type": "Function",
"digest": {
"function_hash": "107632473168057763558308181074389386107",
"length": 1097.0
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c",
"function": "btrfs_encode_fh"
}
},
{
"id": "CVE-2025-40205-ae62a8ac",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@742b44342204e5dfe3926433823623c1a0c581df",
"signature_type": "Function",
"digest": {
"function_hash": "107632473168057763558308181074389386107",
"length": 1097.0
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c",
"function": "btrfs_encode_fh"
}
},
{
"id": "CVE-2025-40205-c0bd739e",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43143776b0a7604d873d1a6f3e552a00aa930224",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244086189841155794775821733469362646947",
"323790943427362853413510485137196649678",
"72567552527598107664382487881119419580",
"324978786881442177104412408728881900717",
"122390478762134762209548579169387038123",
"81691120799006043614730609383698135085",
"77511811599334764385655136544236253099",
"264096260683090031823464152738203644723"
]
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c"
}
},
{
"id": "CVE-2025-40205-dfc166b7",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@742b44342204e5dfe3926433823623c1a0c581df",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"244086189841155794775821733469362646947",
"323790943427362853413510485137196649678",
"72567552527598107664382487881119419580",
"324978786881442177104412408728881900717",
"81542072440905285463568174195160233386",
"120216507296114006420648606231307237713",
"16980727216413262672280913670460181827",
"264096260683090031823464152738203644723"
]
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c"
}
},
{
"id": "CVE-2025-40205-fc73afc1",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3a9a8e1275eb9b87f006b5562a287aea3f6885f",
"signature_type": "Function",
"digest": {
"function_hash": "107632473168057763558308181074389386107",
"length": 1097.0
},
"deprecated": false,
"target": {
"file": "fs/btrfs/export.c",
"function": "btrfs_encode_fh"
}
}
]