InfoSec Signals™
Sign InStart Free
Back to CVE records
Not yet scoredPublished Nov 12, 2025

CVE-2025-40200Squashfs: reject negative file sizes in squashfs_read_inode()

Updated under an hour ago ()

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size. This commit checks for a negative file size and returns EINVAL. [phillip@squashfs.org.uk: only need to check 64 bit quantity]

CVSS
Not yet scored
Weakness (CWE)
Not given
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
Linux
NVD analysis
Deferred
Record last updated
May 11, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
Linux Linux
linux:linux (from the name)
from 6545b246a2c815a8fcd07d58240effb6ec3481b1 before 54170057a5fadd24a37b70de41e61d39284d9bd7; 6545b246a2c815a8fcd07d58240effb6ec3481b1 builds before 2871c74caa3f4f05b429e6bfefebac62dbf1b408; from 6545b246a2c815a8fcd07d58240effb6ec3481b1 before fbfc745db628de31f5c089147deeb87e95b89e66; from 6545b246a2c815a8fcd07d58240effb6ec3481b1 before 8118f66124895829443d09c207e654adcb2f9321; 6545b246a2c815a8fcd07d58240effb6ec3481b1 builds before 8c7aad76751816207fee556d44aa88a710824810; 6545b246a2c815a8fcd07d58240effb6ec3481b1 builds before 875fb3f87ae0225b881319ba016a1a8c4ffd5812; from 6545b246a2c815a8fcd07d58240effb6ec3481b1 before f271155ff31aca8ef82c61c8df23ca97e9a77dd4; 6545b246a2c815a8fcd07d58240effb6ec3481b1 builds before 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2b
CNA record

References

References

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
CVE-2025-40200: Squashfs: reject negative file sizes in squashfs_read_inode() | InfoSec Signals