CVE-2025-40205

A buffer overflow vulnerability was found in the Linux kernel's Btrfs filesystem when encoding file handles. A local user can trigger this issue when the filesystem needs to encode a file handle where the parent directory exists in a different subvolume than the file itself. The function tells callers it will write 32 bytes but actually writes 40 bytes when encoding the parent root ID, resulting in an 8-byte buffer overflow that can corrupt adjacent memory and cause crashes or denial of service.

Btrfs file handle encoding has three size cases: 20 bytes (no parent), 32 bytes (parent in same root), or 40 bytes (parent in different root). The function initially returns either 20 or 32 to the caller, who allocates that much space. If the parent is later discovered to be in a different root, the code writes parent_root_objectid—extending to 40 bytes and overwriting 8 bytes past the allocated buffer. While the specific parent/subvolume conditions make this difficult to trigger, it's a real memory corruption bug.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.