{
  "cveId": "CVE-2025-40295",
  "url": "https://patchblox.com/security/cve/CVE-2025-40295",
  "summary": "CVE-2025-40295 is fixed in linux on 1 platform by DEBIAN-CVE-2025-40295 (version 6.17.8-1), released December 8, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  fscrypt: fix left shift underflow when inode-\u003Ei_...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  fscrypt: fix left shift underflow when inode-\u003Ei_blkbits \u003E PAGE_SHIFT  When simulating an nvme device on qemu with both logical_block_size and physical_block_size set to 8 KiB, an error trace appears during partition table reading at boot time. The issue is caused by inode-\u003Ei_blkbits being larger than PAGE_SHIFT, which leads to a left shift of -1 and triggering a UBSAN warning.  [    2.697306] ------------[ cut here ]------------ [    2.697309] UBSAN: shift-out-of-bounds in fs/crypto/inline_crypt.c:336:37 [    2.697311] shift exponent -1 is negative [    2.697315] CPU: 3 UID: 0 PID: 274 Comm: (udev-worker) Not tainted 6.18.0-rc2\u002B #34 PREEMPT(voluntary) [    2.697317] Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [    2.697320] Call Trace: [    2.697324]  \u003CTASK\u003E [    2.697325]  dump_stack_lvl\u002B0x76/0xa0 [    2.697340]  dump_stack\u002B0x10/0x20 [    2.697342]  __ubsan_handle_shift_out_of_bounds\u002B0x1e3/0x390 [    2.697351]  bh_get_inode_and_lblk_num.cold\u002B0x12/0x94 [    2.697359]  fscrypt_set_bio_crypt_ctx_bh\u002B0x44/0x90 [    2.697365]  submit_bh_wbc\u002B0xb6/0x190 [    2.697370]  block_read_full_folio\u002B0x194/0x270 [    2.697371]  ? __pfx_blkdev_get_block\u002B0x10/0x10 [    2.697375]  ? __pfx_blkdev_read_folio\u002B0x10/0x10 [    2.697377]  blkdev_read_folio\u002B0x18/0x30 [    2.697379]  filemap_read_folio\u002B0x40/0xe0 [    2.697382]  filemap_get_pages\u002B0x5ef/0x7a0 [    2.697385]  ? mmap_region\u002B0x63/0xd0 [    2.697389]  filemap_read\u002B0x11d/0x520 [    2.697392]  blkdev_read_iter\u002B0x7c/0x180 [    2.697393]  vfs_read\u002B0x261/0x390 [    2.697397]  ksys_read\u002B0x71/0xf0 [    2.697398]  __x64_sys_read\u002B0x19/0x30 [    2.697399]  x64_sys_call\u002B0x1e88/0x26a0 [    2.697405]  do_syscall_64\u002B0x80/0x670 [    2.697410]  ? __x64_sys_newfstat\u002B0x15/0x20 [    2.697414]  ? x64_sys_call\u002B0x204a/0x26a0 [    2.697415]  ? do_syscall_64\u002B0xb8/0x670 [    2.697417]  ? irqentry_exit_to_user_mode\u002B0x2e/0x2a0 [    2.697420]  ? irqentry_exit\u002B0x43/0x50 [    2.697421]  ? exc_page_fault\u002B0x90/0x1b0 [    2.697422]  entry_SYSCALL_64_after_hwframe\u002B0x76/0x7e [    2.697425] RIP: 0033:0x75054cba4a06 [    2.697426] Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 \u003C48\u003E 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 [    2.697427] RSP: 002b:00007fff973723a0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 [    2.697430] RAX: ffffffffffffffda RBX: 00005ea9a2c02760 RCX: 000075054cba4a06 [    2.697432] RDX: 0000000000002000 RSI: 000075054c190000 RDI: 000000000000001b [    2.697433] RBP: 00007fff973723c0 R08: 0000000000000000 R09: 0000000000000000 [    2.697434] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [    2.697434] R13: 00005ea9a2c027c0 R14: 00005ea9a2be5608 R15: 00005ea9a2be55f0 [    2.697436]  \u003C/TASK\u003E [    2.697436] ---[ end trace ]---  This situation can happen for block devices because when CONFIG_TRANSPARENT_HUGEPAGE is enabled, the maximum logical_block_size is 64 KiB. set_init_blocksize() then sets the block device inode-\u003Ei_blkbits to 13, which is within this limit.  File I/O does not trigger this problem because for filesystems that do not support the FS_LBS feature, sb_set_blocksize() prevents sb-\u003Es_blocksize_bits from being larger than PAGE_SHIFT. During inode allocation, alloc_inode()-\u003Einode_init_always() assigns inode-\u003Ei_blkbits from sb-\u003Es_blocksize_bits. Currently, only xfs_fs_type has the FS_LBS flag, and since xfs I/O paths do not reach submit_bh_wbc(), it does not hit the left-shift underflow issue.  [EB: use folio_pos() and consolidate the two shifts by i_blkbits]",
  "published": "2025-12-08T01:16:01Z",
  "severity": "",
  "epss": 0.00205,
  "epssPercentile": 0.10552,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.17.8-1",
      "fix": "DEBIAN-CVE-2025-40295",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40295",
      "released": "2025-12-08T01:16:01Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}