CVE-2025-40241 addresses a vulnerability in the Linux kernel's EROFS filesystem implementation involving encoded extents introduced in Linux 6.15. Two specific crafted invalid cases were identified: one where the plen field is non-zero but does not match expected mask conditions, leading to mishandling of special extents; and another where a physical block address exceeds the supported 48-bit range, causing pointer arithmetic to wrap around and result in out-of-bounds access in the z_erofs_submit_queue() function. These issues can lead to system crashes due to memory corruption. The fix involves adding sanity checks to enforce address limits and properly handle special extent cases.

Successful exploitation of this vulnerability can cause system crashes due to out-of-bounds memory access and improper handling of malformed encoded extents in the EROFS filesystem. This results in denial of service and potential system instability. The vulnerability has a high severity rating based on CVSS 3.1 metrics (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating local attacker capability with low complexity and significant impact on confidentiality, integrity, and availability.

A fix for this vulnerability has been implemented in the Linux kernel to address the crafted invalid cases for encoded extents in EROFS. Users should apply the official Linux kernel updates that include this patch. Since no specific patch links or vendor advisories are provided here, users should monitor the official Linux kernel repositories and distributions for the relevant security updates. Patch status is not yet confirmed in this data; check vendor advisories for current remediation guidance.