Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-40198

10
FAUCET Score

CVE-2025-40198 is a buffer over-read vulnerability in the Linux kernel's ext4 filesystem, specifically within the parse_apply_sb_mount_options() function. This flaw arises because the s_mount_opts string in the ext4 superblock is not guaranteed to be NUL-terminated, potentially leading to out-of-bounds reads. While no CVSS score is available, its FAUCET Risk Score is low at 5/100, and its EPSS score is also very low, suggesting minimal exploitability or impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
LinuxLinux
2.6.36CNA affecteddefault affected
LinuxLinux
>= 8b67f04ab9de5d8f3a71aef72bf02c995a506db5, < 01829af7656b56d83682b3491265d583d502e502, >= 8b67f04ab9de5d8f3a71aef72bf02c995a506db5, < 2a0cf438320cdb783e0378570744c0ef0d83e934, >= 8b67f04ab9de5d8f3a71aef72bf02c995a506db5, < 7bf46ff83a0ef11836e38ebd72cdc5107209342d, >= 8b67f04ab9de5d8f3a71aef72bf02c995a506db5, < 8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8, >= 8b67f04ab9de5d8f3a71aef72bf02c995a506db5, < a6e94557cd05adc82fae0400f6e17745563e5412, >= 8b67f04ab9de5d8f3a71aef72bf02c995a506db5, < b2bac84fde28fb6a88817b8b761abda17a1d300b, >= 8b67f04ab9de5d8f3a71aef72bf02c995a506db5, < e651294218d2684302ee5ed95ccf381646f3e5b4CNA affecteddefault unaffected

CVSS Data

CVSS data has not been published for this CVE.

Exploit Intelligence

EPSS Score
0.19%
Probability of exploitation in next 30 days
EPSS Percentile
8.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15

Social Chatter

No social media mentions found for this CVE.

Media Mentions

Remediation

Patch Available

Vendor Patches (38)

microsoftpatch availablevia msrc
Product: 20613-17084Fixed in: 6.6.117.1-1
microsoftpatch availablevia msrc
Product: azl3 kernel 6.6.112.1-2 on Azure Linux 3.0Fixed in: 6.6.117.1-1
ubuntupatch availablevia ubuntu_usn
Product: linux (noble)Fixed in: 6.8.0-106.106
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-6.8 (jammy)Fixed in: 6.8.0-1050.53~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-6.8 (jammy)Fixed in: 6.8.0-1051.57~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (noble)Fixed in: 6.8.0-1051.57
ubuntupatch availablevia ubuntu_usn
Product: linux-xilinx (noble)Fixed in: 6.8.0-1029.30
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (noble)Fixed in: 6.8.0-1050.54
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi-realtime (noble)Fixed in: 6.8.0-2040.41
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-fips (noble)Fixed in: 6.8.0-1052.58+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-fips (noble)Fixed in: 6.8.0-1050.53+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-fips (noble)Fixed in: 6.8.0-106.106+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-fips (noble)Fixed in: 6.8.0-1052.55+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-6.8 (jammy)Fixed in: 6.8.0-1049.52~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia (noble)Fixed in: 6.8.0-1049.52
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-lowlatency (noble)Fixed in: 6.8.0-1049.52.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-6.8 (jammy)Fixed in: 6.8.0-1052.55~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-6.8 (jammy)Fixed in: 6.8.0-106.106~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm-6.8 (jammy)Fixed in: 6.8.0-1049.49~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency-hwe-6.8 (jammy)Fixed in: 6.8.0-106.106.1~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-6.8 (jammy)Fixed in: 6.8.0-1047.48~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (questing)Fixed in: 6.17.0-1008.8
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (noble)Fixed in: 6.8.0-1050.53
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (noble)Fixed in: 6.8.0-1052.55
ubuntupatch availablevia ubuntu_usn
Product: linux-gke (noble)Fixed in: 6.8.0-1048.53
ubuntupatch availablevia ubuntu_usn
Product: linux-gkeop (noble)Fixed in: 6.8.0-1035.38
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm (noble)Fixed in: 6.8.0-1049.49
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency (noble)Fixed in: 6.8.0-106.106.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (noble)Fixed in: 6.8.0-1047.48
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime-6.8 (jammy)Fixed in: 6.8.1-1045.46~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (noble)Fixed in: 6.8.1-1045.46
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel-rt
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: kernel-rt
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel-rt
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: kernel

Vendor Advisories (13)

ubuntuUSN-8261-1

Linux kernel (Xilinx) vulnerabilities

May 7, 2026
ubuntuUSN-8165-1

Linux kernel (Azure FIPS) vulnerabilities

Apr 9, 2026
ubuntuUSN-8095-5

Linux kernel (Raspberry Pi) vulnerabilities

Apr 1, 2026
ubuntuUSN-8126-1

Linux kernel (Azure) vulnerabilities

Mar 25, 2026
ubuntuUSN-8125-1

Linux kernel (Azure) vulnerabilities

Mar 25, 2026
ubuntuUSN-8095-4

Linux kernel (AWS) vulnerabilities

Mar 23, 2026
ubuntuUSN-8095-3

Linux kernel (Real-time) vulnerabilities

Mar 17, 2026
ubuntuUSN-8095-2

Linux kernel (FIPS) vulnerabilities

Mar 16, 2026
ubuntuUSN-8100-1

Linux kernel (NVIDIA) vulnerabilities

Mar 16, 2026
ubuntuUSN-8095-1

Linux kernel vulnerabilities

Mar 16, 2026
ubuntuUSN-8029-3

Linux kernel (Azure) vulnerabilities

Feb 24, 2026
redhatCVE-2025-40198Low

kernel: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()

Nov 12, 2025
microsoft2025-Nov/CVE-2025-40198Important

ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()

Nov 11, 2025

References

git.kernel.org / stable/c/01829af7656b56d83682b3491265d583d502e502
git.kernel.org / stable/c/2a0cf438320cdb783e0378570744c0ef0d83e934
git.kernel.org / stable/c/7bf46ff83a0ef11836e38ebd72cdc5107209342d
git.kernel.org / stable/c/8ecb790ea8c3fc69e77bace57f14cf0d7c177bd8
git.kernel.org / stable/c/a6e94557cd05adc82fae0400f6e17745563e5412
git.kernel.org / stable/c/b2bac84fde28fb6a88817b8b761abda17a1d300b
git.kernel.org / stable/c/e651294218d2684302ee5ed95ccf381646f3e5b4