CVE-2025-40306: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40306 is a buffer overflow vulnerability in the Linux kernel's orangefs filesystem, specifically in the xattr_key() helper function. The flaw was disclosed on December 8, 2025, and affects the Linux kernel on systems using the orangefs filesystem. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring only low-privilege local access with no user interaction (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an improper loop condition in the xattr_key() helper function (CWE-120: Buffer Copy without Checking Size of Input). The loop checks the pointer variable key itself rather than dereferencing it — since key is incremented and remains non-NULL until it hits unmapped memory, the loop walks memory indefinitely instead of terminating on a null byte. A secondary bug was also identified: after fixing xattr_key(), xfstest generic/069 exposed a memory leak in the orangefs xattr cache, where hash_add double-hashed keys, causing cache entries to land in wrong hash buckets and resulting in unbounded kmalloc calls that were never freed, leading to OOM conditions. Exploitation requires a local user to perform xattr operations (e.g., via setfattr/getfattr) on an orangefs-mounted filesystem (Red Hat Bugzilla).

A low-privileged local attacker can trigger a kernel oops, hang user processes, and cause indefinite CPU consumption by performing xattr operations on an orangefs filesystem. The secondary memory leak can lead to Out-of-Memory (OOM) conditions, causing system instability or denial of service. File corruption of orangefs files is also possible. There is no confidentiality or integrity impact beyond potential filesystem corruption; the primary risk is availability (Red Hat Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.03% (0.000300), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was originally reported by a researcher via Willy Tarreau and the Disclosure mailing list (Red Hat Bugzilla).

1. Precondition: Obtain a low-privilege local account on a Linux system with an orangefs filesystem mounted.
2. Trigger the loop bug: Use setfattr or getfattr to set or retrieve extended attributes on a file residing on the orangefs mount (e.g., setfattr -n user.test -v value /mnt/orangefs/file).
3. Observe kernel oops: The malformed loop in xattr_key() walks memory indefinitely, causing a kernel oops and potentially hanging the calling process and other user processes.
4. Trigger OOM (secondary): Repeatedly perform getattr operations for xattrs such as security.capability on a single orangefs file; each call results in a new kmalloc that is never freed due to the wrong hash bucket placement, eventually exhausting kernel memory and triggering OOM conditions (Red Hat Bugzilla).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output referencing orangefs or xattr operations; OOM killer invocations logged in kernel messages.
• Process: Hung user processes blocked on setfattr or getfattr system calls against an orangefs mount; unusually high CPU usage from kernel threads processing xattr operations.
• File System: Corrupted files on orangefs mounts following kernel oops events.

Apply the upstream Linux kernel patch that corrects the xattr_key() loop condition and replaces hash_add with hlist_add_head to fix the memory leak. Patches are referenced in the upstream kernel stable tree (commits 15afebb9597449c444801d1ff0b8d8b311f950ab, 025e880759c279ec64d0f754fe65bf45961da864, 9127d1e90c90e5960c8bc72a4ce2c209691a7021). Debian LTS (linux 6.1, DLA-4436-1), Ubuntu (USN-8096-1, USN-8096-2, USN-8096-3, USN-8116-1), and Red Hat have issued advisories. As a workaround where immediate patching is not possible, restrict local user access to orangefs mounts or temporarily disable xattr operations on orangefs (Red Hat Bugzilla, Debian LTS).

The vulnerability was originally reported through responsible disclosure via Willy Tarreau, who forwarded a message from the Disclosure mailing list to the kernel maintainers. The fix was developed by the orangefs maintainer based on a suggested diff from the reporter. Red Hat, Debian, and Ubuntu have all issued security advisories, and the issue was covered in Microsoft's December 2025 Patch Tuesday roundup by Lansweeper and Rapid7 in the context of Linux kernel updates (Red Hat Bugzilla).