CVE-2025-40200

An integer validation issue was found in the Linux kernel's Squashfs filesystem when reading inode metadata. A local user can trigger this issue by mounting a maliciously crafted Squashfs image containing inodes with negative file sizes. When overlayfs attempts to copy up such files, the negative size value causes warnings in the VFS layer and can lead to unexpected behavior, memory corruption, or denial of service through system instability.

Squashfs reads on-disk inode structures without validating that file sizes are non-negative. A crafted image with negative file sizes causes warnings when overlayfs attempts copy-up operations, as the negative value confuses VFS copy routines. Depending on how the negative value propagates through size calculations, it can cause buffer operations with nonsensical lengths or other undefined behavior. The fix rejects negative file sizes during inode reading.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.