CVE-2025-40295: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-40295 is a Linux kernel vulnerability in the fscrypt (filesystem encryption) module, specifically in fs/crypto/inline_crypt.c, caused by a left shift underflow when inode->i_blkbits is greater than PAGE_SHIFT. This condition can occur on block devices with large logical and physical block sizes (e.g., 8 KiB), such as when simulating an NVMe device on QEMU, triggering a UBSAN (Undefined Behavior Sanitizer) shift-out-of-bounds warning during partition table reading at boot time. The vulnerability was disclosed on December 8, 2025, and affects the Linux kernel (confirmed on 6.18.0-rc2+). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an integer underflow in a left-shift operation within bh_get_inode_and_lblk_num() in fs/crypto/inline_crypt.c (line 336). When CONFIG_TRANSPARENT_HUGEPAGE is enabled, the maximum logical block size is 64 KiB, allowing set_init_blocksize() to set inode->i_blkbits to 13 (larger than PAGE_SHIFT, typically 12 on x86-64). The shift expression then computes a negative exponent (-1), which is undefined behavior under C standards and triggers a UBSAN warning. This path is reachable via fscrypt_set_bio_crypt_ctx_bh() → submit_bh_wbc() during block device reads; it does not affect filesystems that enforce sb->s_blocksize_bits <= PAGE_SHIFT (e.g., all non-XFS filesystems), and XFS (the only filesystem with FS_LBS) does not reach submit_bh_wbc(). The CWE classification is CWE-191 (Integer Underflow) (Red Hat Bugzilla).

Successful triggering of this vulnerability results in a UBSAN warning and potential system instability or denial of service, particularly during boot-time partition table reading on affected hardware configurations. Availability is the primary impact (CVSS availability impact: High), with no confidentiality or integrity impact. The issue is most likely to affect systems using QEMU-simulated NVMe devices with large block sizes or physical hardware with block sizes exceeding the system page size when CONFIG_TRANSPARENT_HUGEPAGE is enabled (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires a local attacker with low privileges and a specific hardware or emulation configuration (block size > PAGE_SHIFT with CONFIG_TRANSPARENT_HUGEPAGE enabled), significantly limiting its practical exploitability. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. CVE-2025-40295 is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Advisory).

The primary remediation is to update to a patched Linux kernel version that includes the fix for fs/crypto/inline_crypt.c (patch commits available in the stable kernel tree). As a temporary workaround, disabling CONFIG_TRANSPARENT_HUGEPAGE in the kernel configuration prevents the maximum logical block size from exceeding PAGE_SHIFT, eliminating the vulnerable condition. For QEMU-based environments, avoid configuring NVMe devices with logical_block_size and physical_block_size set to values larger than the host page size. Monitoring system logs for UBSAN warnings related to shift operations can help identify affected systems (Red Hat Bugzilla, Red Hat Advisory).