CVE-2025-40306

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the orangefs module related to extended attribute (xattr) handling. The xattr key() helper function incorrectly uses a pointer variable in the loop condition instead of dereferencing it, leading to a potentially infinite loop that can consume CPU resources, hang threads, or cause kernel oops errors. This issue can corrupt orangefs files. Additionally, a memory leak was identified and addressed in the xattr cache due to incorrect hashing within the hash add function, which was resolved by switching to hlist add head. This memory leak manifested as out-of-memory (OOM) conditions during testing with the xfstest tool. The issue was reproducible using setfattr and getfattr.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.