CVE-2025-40200

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: reject negative file sizes in squashfs_read_inode()

Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.

This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size.

This commit checks for a negative file size and returns EINVAL.

[phillip@squashfs.org.uk: only need to check 64 bit quantity]

Metrics

No CVSS score has been published yet.

Affected software

No affected versions have been published.

Timeline

Published
Nov 12, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-402017.8In the Linux kernel, the following vulnerability has been resolved: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sysCVE-2025-402027.8In the Linux kernel, the following vulnerability has been resolved: ipmi: Rework user message limit handling The limit on the number of usCVE-2025-402037.8In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage lisCVE-2025-402048.1In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacksCVE-2025-402057.8In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The functionCVE-2025-402067.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions ReferCVE-2025-40207In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_tCVE-2025-40208In the Linux kernel, the following vulnerability has been resolved: media: iris: fix module removal if firmware download failed Fix removeCVE-2025-40209In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation WheCVE-2025-40217.5A vulnerability was found in code-projects Patient Record Management System 1.0. It has been classified as critical. This affects an unknownCVE-2025-402107.5In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUNDCVE-2025-40211In the Linux kernel, the following vulnerability has been resolved: ACPI: video: Fix use-after-free in acpi_video_switch_brightness() The
CVE-2025-40200: Unscored | Vulnix