Security readout for executives and security teams
Plain-English summary
A malformed ext4 superblock mount-options field can cause the Linux kernel to read beyond its intended buffer while processing a filesystem. The supplied CVSS assessment indicates potentially serious confidentiality, integrity, and availability impact. However, the sources do not establish a specific resulting outcome such as code execution.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially on systems that mount externally supplied filesystems. Expedite vendor updates for exposed hosts, but the evidence does not support an internet-wide emergency response: the vector is local, interaction is required, and active exploitation is not established.
Technical view
parse_apply_sb_mount_options() assumed the ext4 s_mount_opts field was NUL-terminated by tune2fs. A missing terminator could let string processing read beyond the field. The referenced Linux stable changes harden parsing by treating s_mount_opts as a potential nonstring. The bundle provides no CWE or detailed failure mechanism.
Likely exposure
Exposure is contextual: affected Linux kernels must process an ext4 filesystem containing the problematic mount-options field. The CVSS vector is local, requires user interaction, and reports no privileges required. This is not described as a directly network-reachable vulnerability. The supplied version data does not define clean affected ranges for every kernel branch.
Exploitation context
The supplied record says this CVE is not in KEV and provides no evidence of active exploitation, public proof-of-concept activity, or weaponization. CVSS rates exploitation as local with low complexity and required user interaction. No exploit path beyond the buffer over-read condition is documented in the bundle.
Researcher notes
The central condition is a potentially unterminated s_mount_opts field causing an over-read during superblock mount-option parsing. The bundle repeats an unaffected commit identifier and lists affected versions without explicit branch ranges. Researchers and vulnerability managers should use vendor backport evidence or the applicable stable commits rather than version-string comparisons alone.
Mitigation direction
- Inventory Linux systems that mount ext4 and map vendor kernel packages to affected and fixed upstream revisions.
- Apply vendor-supported kernel updates containing the applicable stable fix, then reboot into the updated kernel.
- Until patched, restrict mounting ext4 filesystems from untrusted media or images where operationally feasible.
- Check distribution guidance for backport status and supported compensating controls.
Validation and detection
- Record active kernel and package versions on every system capable of mounting ext4.
- Confirm vendor advisories or source changelogs include an applicable referenced stable commit.
- After reboot, verify the active kernel is the remediated package, not merely installed.
- Review workflows mounting externally supplied ext4 media or images to prioritize exposed hosts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40198 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7bf46ff83a0ef11836e38ebd72cdc5107209342dCVE reference, Linux
- https://git.kernel.org/stable/c/b2bac84fde28fb6a88817b8b761abda17a1d300bCVE reference, Linux
- https://git.kernel.org/stable/c/e651294218d2684302ee5ed95ccf381646f3e5b4CVE reference, Linux
- https://git.kernel.org/stable/c/01829af7656b56d83682b3491265d583d502e502CVE reference, Linux
- https://git.kernel.org/stable/c/2a0cf438320cdb783e0378570744c0ef0d83e934CVE reference, Linux
- https://git.kernel.org/stable/c/a6e94557cd05adc82fae0400f6e17745563e5412CVE reference, Linux
- https://git.kernel.org/stable/c/8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.