CVE-2025-38710

MEDIUM EPSS 3.4%
Published Sep 4, 20259mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Sep 4, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at: index = hash >> (32 - dip->i_depth); As calculated in an open-coded way in dir_make_exhash(), the minimum depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time. So we can avoid the undefined behaviour by checking for depth values lower than the minimum in gfs2_dinode_in(). Values greater than the maximum are already being checked for there. Also switch the calculation in dir_make_exhash() to use ilog2() to clarify how the depth is calculated. Tested with the syzkaller repro.c and xfstests '-g quick'.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
3.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 3

VendorProductVersionRange
linuxlinux_kernel* <6.12.43
linuxlinux_kernel*≥6.13  –  <6.15.11
linuxlinux_kernel*≥6.16  –  <6.16.2

References 8

  • git.kernel.org https://git.kernel.org/stable/c/076e992752e4b24178918f748d75597c80a408d2
  • git.kernel.org https://git.kernel.org/stable/c/112bb60cd0e254a369e95aa9941a694ffeca089f
  • git.kernel.org https://git.kernel.org/stable/c/366183911b153e9b8cf758e1414e1154d7569337
  • git.kernel.org https://git.kernel.org/stable/c/53a0249d68a210c16e961b83adfa82f94ee0a53d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/557c024ca7250bb65ae60f16c02074106c2f197b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9680c58675b82348ab84d387e4fa727f7587e1a0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b5f46951e62377b6e406fadc18bc3c5bdf1632a7
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cddea0c721106ea480371412d8de21705eb27376

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/53a0249d68a210c16e961b83adfa82f94ee0a53d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/557c024ca7250bb65ae60f16c02074106c2f197b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9680c58675b82348ab84d387e4fa727f7587e1a0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b5f46951e62377b6e406fadc18bc3c5bdf1632a7
    Patch