Linux Kernel Vulnerability in VFAT Filesystem on QEMU by The Linux Foundation

CVE-2025-40265

What is CVE-2025-40265?

A vulnerability in the Linux kernel's VFAT filesystem can cause a kernel panic when emulating an NVMe device on QEMU. This occurs if both logical_block_size and physical_block_size are configured to 8 KiB without proper formatting, leading to failure during the early boot stage while attempting to mount the filesystem. This issue has been addressed by ensuring the return value checks for sb_min_blocksize() are properly implemented, mitigating conditions that trigger the kernel panic.

References