CVE-2025-40306

What it actually does

Incorrect pointer check in xattr_key() causes unbounded memory walk instead of terminating on valid strings; misuse of hash_add places xattr cache entries in wrong buckets resulting in repeated kmalloc without frees and memory leak.

Why it matters to the business

Kernel oops, hung processes, file corruption, high CPU usage and potential out-of-memory conditions on systems using orangefs; low EPSS and no KEV status indicate limited active exploitation risk despite 322 days since publication.

How an attack unfolds

Local attacker invokes setfattr or getfattr against files on an orangefs filesystem, triggering the faulty loop condition and cache misplacement; repeated getattr operations on attributes like security.capability amplify the leak until resource exhaustion or crash occurs.

How to fix it

Apply upstream kernel fix replacing hash_add with hlist_add_head and correcting xattr_key loop; upgrade affected ghostscript packages on Ubuntu 14.04 LTS and 16.04 LTS to 9.26~dfsg+0-0ubuntu0.14.04.1 or 9.26~dfsg+0-0ubuntu0.16.04.1 respectively.

How to confirm the fix worked

Confirm kernel source contains corrected xattr_key dereference and hlist_add_head usage; run xfstest generic/069 against orangefs to verify no leak; check package versions match listed fixed releases.

Typical attack path

1. Obtain local access to a system with orangefs mounted
2. Execute setfattr/getfattr or equivalent xattr operations on files
3. Trigger repeated getattr for cached attributes to induce leak or infinite walk
4. Observe kernel oops, process hangs or OOM

How to detect it

Review kernel logs for oops or hung task messages involving orangefs xattr; inspect memory usage patterns during repeated getattr calls on security.capability; check for excessive kmalloc activity without corresponding frees in xattr cache paths.

What your security team should do

• Prioritize kernel upgrades on any orangefs deployments within 30 days
• Monitor for high CPU or memory usage tied to xattr operations
• Audit extended attribute usage on orangefs filesystems
• Verify ghostscript package versions on Ubuntu LTS systems match fixed releases