CVE-2025-38710gfs2: Validate i_depth for exhash directories
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at: index = hash >> (32 - dip->i_depth); As calculated in an open-coded way in dir_make_exhash(), the minimum depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time. So we can avoid the undefined behaviour by checking for depth values lower than the minimum in gfs2_dinode_in(). Values greater than the maximum are already being checked for there. Also switch the calculation in dir_make_exhash() to use ilog2() to clarify how the depth is calculated. Tested with the syzkaller repro.c and xfstests '-g quick'.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from 9a0045088d888c9c539c8c626a366cb52c0fbdab before 076e992752e4b24178918f748d75597c80a408d2; from 9a0045088d888c9c539c8c626a366cb52c0fbdab before 366183911b153e9b8cf758e1414e1154d7569337; from 9a0045088d888c9c539c8c626a366cb52c0fbdab before 112bb60cd0e254a369e95aa9941a694ffeca089f; from 9a0045088d888c9c539c8c626a366cb52c0fbdab before cddea0c721106ea480371412d8de21705eb27376; from 9a0045088d888c9c539c8c626a366cb52c0fbdab before 53a0249d68a210c16e961b83adfa82f94ee0a53d; from 9a0045088d888c9c539c8c626a366cb52c0fbdab before b5f46951e62377b6e406fadc18bc3c5bdf1632a7; from 9a0045088d888c9c539c8c626a366cb52c0fbdab before 9680c58675b82348ab84d387e4fa727f7587e1a0; from 9a0045088d888c9c539c8c626a366cb52c0fbdab before 557c024ca7250bb65ae60f16c02074106c2f197b | CNA record |
linux linux_kernel linux:linux_kernel | before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2 | NVD |
References
- https://git.kernel.org/stable/c/076e992752e4b24178918f748d75597c80a408d2
- https://git.kernel.org/stable/c/366183911b153e9b8cf758e1414e1154d7569337
- https://git.kernel.org/stable/c/112bb60cd0e254a369e95aa9941a694ffeca089f
- https://git.kernel.org/stable/c/cddea0c721106ea480371412d8de21705eb27376
- https://git.kernel.org/stable/c/53a0249d68a210c16e961b83adfa82f94ee0a53dpatch
- https://git.kernel.org/stable/c/b5f46951e62377b6e406fadc18bc3c5bdf1632a7patch
- https://git.kernel.org/stable/c/9680c58675b82348ab84d387e4fa727f7587e1a0patch
- https://git.kernel.org/stable/c/557c024ca7250bb65ae60f16c02074106c2f197bpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.