SECUFOCUSNOW
Home›CVE index›CVE-2025-40306
Review reviewHigh

CVE-2025-40306

Linux

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix xattr related buffer overflow... Willy Tarreau <w@1wt.eu> forwarded me a message from Disclosure <disclosure@aisle.com> with the following warning: > The helper `xattr_key()` uses the pointer variable in the loop condition > rather than dereferencing it. As `key` is incremented, it remains non-NULL > (until it runs into unmapped memory), so the loop does not terminate on > valid C strings and will walk memory indefinitely, consuming CPU or hanging > the thread. I easily reproduced this with setfattr and getfat...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.12.08
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix xattr related buffer overflow... Willy Tarreau <w@1wt.eu> forwarded me a message from Disclosure <disclosure@aisle.com> with the following warning: > The helper `xattr_key()` uses the pointer variable in the loop condition > rather than dereferencing it. As `key` is incremented, it remains non-NULL > (until it runs into unmapped memory), so the loop does not terminate on > valid C strings and will walk memory indefinitely, consuming CPU or hanging > the thread. I easily reproduced this with setfattr and getfat...

Affected product and versions

Product
Linux
Affected versions
>= f7ab093f74bf638ed98fd1115f3efa17e308bb7f < c6564ff6b53c9a8dc786b6f1c51ae7688273f931, >= f7ab093f74bf638ed98fd1115f3efa17e308bb7f < ef892d2bf4f3fa2c8de1677dd307e678bdd3d865, >= f7ab093f74bf638ed98fd1115f3efa17e308bb7f < 15afebb9597449c444801d1ff0b8d8b311f950ab, >= f7ab093f74bf638ed98fd1115f3efa17e308bb7f < bc812574de633cf9a9ad6974490e45f6a4bb5126, >= f7ab093f74bf638ed98fd1115f3efa17e308bb7f < e09a096104fc65859422817fb2211f35855983fe, >= f7ab093f74bf638ed98fd1115f3efa17e308bb7f < 9127d1e90c90e5960c8bc72a4ce2c209691a7021, >= f7ab093f74bf638ed98fd1115f3efa17e308bb7f < c2ca015ac109fd743fdde27933d59dc5ad46658e, >= f7ab093f74bf638ed98fd1115f3efa17e308bb7f < 025e880759c279ec64d0f754fe65bf45961da864, >= 4.6
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available