CVE-2025-40246: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40246 is an out-of-bounds memory read vulnerability in the Linux kernel's XFS filesystem subsystem, specifically within the symlink repair code path (xrep_symlink_salvage_inline). The flaw was disclosed on December 4, 2025, and affects the Linux kernel's XFS online repair (scrub) functionality. It was identified via KFENCE (Kernel Electric Fence) during testing with the xfs/286 test case. The vulnerability has a low EPSS score of 0.024% and no CVSS score has been publicly assigned as of the time of this report (Feedly).

The root cause is an out-of-bounds read (CWE-125) in the xrep_symlink_salvage_inline() function within the XFS kernel module. During symlink repair operations triggered via the xfs_scrub_metadata ioctl path, the function performs a memcpy that reads 184 bytes beyond the end of a KFENCE-tracked allocation. The allocation originates from xfs_init_local_fork() when loading an inode's local data fork, and the overread occurs when the repair code does not correctly bound the copy length against the actual allocated buffer size. Exploitation requires local access to trigger the XFS scrub ioctl (xfs_ioc_scrubv_metadata) on a filesystem containing a malformed or specially crafted symlink inode (Feedly).

The vulnerability causes an out-of-bounds memory read in kernel space, which can lead to kernel information disclosure (reading adjacent kernel memory) or a kernel panic/crash, impacting system availability. Because the read occurs in kernel context during a privileged scrub operation, sensitive kernel memory contents could potentially be exposed to a local attacker. The integrity of the system is not directly affected, but a kernel crash would result in a denial of service (Feedly).

There is no known public proof-of-concept exploit code, no evidence of in-the-wild exploitation, and CVE-2025-40246 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.024%, reflecting a low probability of exploitation in the near term. Exploitation requires local access to a system running a vulnerable Linux kernel with XFS mounted and the ability to invoke the XFS scrub ioctl (Feedly).

The fix has been committed to the Linux kernel stable tree via multiple patches (commits 7c2d68e09158, 81a8685cac4b, and 678e1cc2f482). Downstream distributions including Ubuntu (USN-8094-1 through USN-8094-5, USN-8152-1), SUSE, Oracle Linux (ELSA-2026-50112), and Red Hat have issued updated kernel packages incorporating this fix. Administrators should update to the latest patched kernel version provided by their distribution. As a temporary workaround, avoiding the use of xfs_scrub on filesystems with potentially malformed symlinks can reduce exposure (Ubuntu Advisory, Feedly).