Vulnerability-Lookup

FKIE_CVE-2025-38652

Vulnerability from fkie_nvd - Published: 2025-08-22 16:15 - Updated: 2026-07-30 06:23

Severity

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in devs.path - touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - truncate -s $((1024*1024*1024)) \ /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - touch /mnt/f2fs/file - truncate -s $((1024*1024*1024)) /mnt/f2fs/file - mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ -c /mnt/f2fs/file - mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ /mnt/f2fs/loop [16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\xff\x01, 511, 0 - 3ffff [16937.192268] F2FS-fs (loop0): Failed to find devices If device path length equals to MAX_PATH_LEN, sbi->devs.path[] may not end up w/ null character due to path array is fully filled, So accidently, fields locate after path[] may be treated as part of device path, result in parsing wrong device path. struct f2fs_dev_info { ... char path[MAX_PATH_LEN]; ... }; Let's add one byte space for sbi->devs.path[] to store null character of device path string.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1b1efa5f0e878745e94a98022e8edc675a87d78e	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1cf1ff15f262e8baf12201b270b6a79f9d119b2d	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/345fc8d1838f3f8be7c8ed08d86a13dedef67136	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3466721f06edff834f99d9f49f23eabc6b2cb78e	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5661998536af52848cc4d52a377e90368196edea	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/666b7cf6ac9aa074b8319a2b68cba7f2c30023f0	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/755427093e4294ac111c3f9e40d53f681a0fbdaa	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	Third Party Advisory

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
debian	debian_linux	11.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "1cf1ff15f262e8baf12201b270b6a79f9d119b2d",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "666b7cf6ac9aa074b8319a2b68cba7f2c30023f0",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "3466721f06edff834f99d9f49f23eabc6b2cb78e",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "345fc8d1838f3f8be7c8ed08d86a13dedef67136",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "70849d33130a2cf1d6010069ed200669c8651fbd",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "755427093e4294ac111c3f9e40d53f681a0fbdaa",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "1b1efa5f0e878745e94a98022e8edc675a87d78e",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "5661998536af52848cc4d52a377e90368196edea",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB160546-0976-47FA-8A9A-8FC573930034",
              "versionEndExcluding": "5.4.297",
              "versionStartIncluding": "4.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0D21C35-EB8A-488A-BBF9-403E4817E5DD",
              "versionEndExcluding": "5.10.241",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD9E597F-3DDE-4D7E-976C-463D0611F13F",
              "versionEndExcluding": "5.15.190",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E5B1B93-C244-4B54-B3AB-12C2635A443B",
              "versionEndExcluding": "6.1.148",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD6EDB96-08AC-49D8-A1A9-4D2140C49BC7",
              "versionEndExcluding": "6.6.102",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA7AA5E6-4376-4A85-A021-6ACC5FF801C3",
              "versionEndExcluding": "6.12.42",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5890C690-B295-40C2-9121-FF5F987E5142",
              "versionEndExcluding": "6.15.10",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB",
              "versionEndExcluding": "6.16.1",
              "versionStartIncluding": "6.16",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-boundary access in devs.path\n\n- touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- truncate -s $((1024*1024*1024)) \\\n  /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- touch /mnt/f2fs/file\n- truncate -s $((1024*1024*1024)) /mnt/f2fs/file\n- mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  -c /mnt/f2fs/file\n- mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  /mnt/f2fs/loop\n\n[16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\\xff\\x01,      511,        0 -    3ffff\n[16937.192268] F2FS-fs (loop0): Failed to find devices\n\nIf device path length equals to MAX_PATH_LEN, sbi-\u003edevs.path[] may\nnot end up w/ null character due to path array is fully filled, So\naccidently, fields locate after path[] may be treated as part of\ndevice path, result in parsing wrong device path.\n\nstruct f2fs_dev_info {\n...\n\tchar path[MAX_PATH_LEN];\n...\n};\n\nLet\u0027s add one byte space for sbi-\u003edevs.path[] to store null\ncharacter of device path string."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: correcci\u00f3n para evitar el acceso fuera de los l\u00edmites en devs.path - touch /mnt/f2fs/0123456789012345678901234567890123456789012345678901234567890123 - truncate -s $((1024*1024*1024)) \\ /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - touch /mnt/f2fs/file - truncate -s $((1024*1024*1024)) /mnt/f2fs/file - mkfs.f2fs /mnt/f2fs/0123456789012345678901234567890123456789012345678901234567890123 \\ -c /mnt/f2fs/file - mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\ /mnt/f2fs/loop [16937.192225] F2FS-fs (loop0): Montar dispositivo [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\\xff\\x01, 511, 0 - 3ffff [16937.192268] F2FS-fs (loop0): Error al encontrar dispositivos Si la longitud de la ruta del dispositivo es igual a MAX_PATH_LEN, sbi-\u0026gt;devs.path[] puede no terminar con un car\u00e1cter nulo debido a que la matriz de ruta est\u00e1 completamente llena, por lo que accidentalmente, los campos ubicados despu\u00e9s de path[] pueden tratarse como parte de la ruta del dispositivo, lo que da como resultado el an\u00e1lisis de una ruta de dispositivo incorrecta. Agreguemos un espacio de byte para que sbi-\u0026gt;devs.path[] almacene el car\u00e1cter nulo de la cadena de ruta del dispositivo."
    }
  ],
  "id": "CVE-2025-38652",
  "lastModified": "2026-07-30T06:23:32.853",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.5,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-08-22T16:15:40.057",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1b1efa5f0e878745e94a98022e8edc675a87d78e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1cf1ff15f262e8baf12201b270b6a79f9d119b2d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/345fc8d1838f3f8be7c8ed08d86a13dedef67136"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3466721f06edff834f99d9f49f23eabc6b2cb78e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5661998536af52848cc4d52a377e90368196edea"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/666b7cf6ac9aa074b8319a2b68cba7f2c30023f0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/755427093e4294ac111c3f9e40d53f681a0fbdaa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2025-38652 (GCVE-0-2025-38652)

Vulnerability from cvelistv5 – Published: 2025-08-22 16:00 – Updated: 2026-08-05 12:03

Title

f2fs: fix to avoid out-of-boundary access in devs.path

Summary

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6653 records in the last 180 days details

References

11 references

URL	Tags
https://git.kernel.org/stable/c/dc0172c74bd9edaee…
https://git.kernel.org/stable/c/1cf1ff15f262e8baf…
https://git.kernel.org/stable/c/666b7cf6ac9aa074b…
https://git.kernel.org/stable/c/3466721f06edff834…
https://git.kernel.org/stable/c/345fc8d1838f3f8be…
https://git.kernel.org/stable/c/70849d33130a2cf1d…
https://git.kernel.org/stable/c/755427093e4294ac1…
https://git.kernel.org/stable/c/1b1efa5f0e878745e…
https://git.kernel.org/stable/c/5661998536af52848…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3c62be17d4f562f43fe1d03b48194399caa35aa5 , < dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80 (git) Affected: 3c62be17d4f562f43fe1d03b48194399caa35aa5 , < 1cf1ff15f262e8baf12201b270b6a79f9d119b2d (git) Affected: 3c62be17d4f562f43fe1d03b48194399caa35aa5 , < 666b7cf6ac9aa074b8319a2b68cba7f2c30023f0 (git) Affected: 3c62be17d4f562f43fe1d03b48194399caa35aa5 , < 3466721f06edff834f99d9f49f23eabc6b2cb78e (git) Affected: 3c62be17d4f562f43fe1d03b48194399caa35aa5 , < 345fc8d1838f3f8be7c8ed08d86a13dedef67136 (git) Affected: 3c62be17d4f562f43fe1d03b48194399caa35aa5 , < 70849d33130a2cf1d6010069ed200669c8651fbd (git) Affected: 3c62be17d4f562f43fe1d03b48194399caa35aa5 , < 755427093e4294ac111c3f9e40d53f681a0fbdaa (git) Affected: 3c62be17d4f562f43fe1d03b48194399caa35aa5 , < 1b1efa5f0e878745e94a98022e8edc675a87d78e (git) Affected: 3c62be17d4f562f43fe1d03b48194399caa35aa5 , < 5661998536af52848cc4d52a377e90368196edea (git)
Linux	Linux	Affected: 4.10 Unaffected: 0 , < 4.10 (semver) Unaffected: 5.4.297 , ≤ 5.4.* (semver) Unaffected: 5.10.241 , ≤ 5.10.* (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.148 , ≤ 6.1.* (semver) Unaffected: 6.6.102 , ≤ 6.6.* (semver) Unaffected: 6.12.42 , ≤ 6.12.* (semver) Unaffected: 6.15.10 , ≤ 6.15.* (semver) Unaffected: 6.16.1 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:45.643Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "1cf1ff15f262e8baf12201b270b6a79f9d119b2d",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "666b7cf6ac9aa074b8319a2b68cba7f2c30023f0",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "3466721f06edff834f99d9f49f23eabc6b2cb78e",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "345fc8d1838f3f8be7c8ed08d86a13dedef67136",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "70849d33130a2cf1d6010069ed200669c8651fbd",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "755427093e4294ac111c3f9e40d53f681a0fbdaa",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "1b1efa5f0e878745e94a98022e8edc675a87d78e",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "5661998536af52848cc4d52a377e90368196edea",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-boundary access in devs.path\n\n- touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- truncate -s $((1024*1024*1024)) \\\n  /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- touch /mnt/f2fs/file\n- truncate -s $((1024*1024*1024)) /mnt/f2fs/file\n- mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  -c /mnt/f2fs/file\n- mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  /mnt/f2fs/loop\n\n[16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\\xff\\x01,      511,        0 -    3ffff\n[16937.192268] F2FS-fs (loop0): Failed to find devices\n\nIf device path length equals to MAX_PATH_LEN, sbi-\u003edevs.path[] may\nnot end up w/ null character due to path array is fully filled, So\naccidently, fields locate after path[] may be treated as part of\ndevice path, result in parsing wrong device path.\n\nstruct f2fs_dev_info {\n...\n\tchar path[MAX_PATH_LEN];\n...\n};\n\nLet\u0027s add one byte space for sbi-\u003edevs.path[] to store null\ncharacter of device path string."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only trigger is `mount(2)` of a crafted f2fs image whose superblock `devs[].path` is a full 64 bytes with no terminator (`get_tree_bdev` \u2192 `f2fs_fill_super` \u2192 `f2fs_scan_devices`), and the resulting disclosure is read back locally via `/proc/fs/f2fs/\u003cdev\u003e/disk_map`. No network or peer-supplied data reaches this code; between Physical (removable media) and Local, the higher-severity Local applies.\nAC:L - The attacker fully controls the on-disk `f2fs_device.path[64]` bytes and the adjacent `total_segments` value, so filling the path completely deterministically leaves `sbi-\u003edevs[i].path` unterminated on every mount \u2014 exactly as the reporter demonstrated. There is no race, no memory-layout guessing, and the trailing struct fields (`start_blk`/`end_blk`) are deterministically derived from segment counts the attacker chooses.\nPR:N - The attacker needs no account or privileges on the victim system \u2014 only delivery of a malicious f2fs image on an SD card, USB stick, or disk image that a privileged auto-mount daemon (Android vold, udisks2) or administrator later processes, which is the most severe reasonable scenario for f2fs given its role as the standard Android/removable-media filesystem.\nUI:R - f2fs does not set `FS_USERNS_MOUNT`, so mounting requires `CAP_SYS_ADMIN` in the initial user namespace; the crafted image therefore reaches the vulnerable code only when a victim inserts the media or mounts the image, and that mount action constitutes user interaction.\nS:U - The over-read, the leaked slab contents, and any resulting fault all remain within the kernel\u0027s own security authority on the host performing the mount; no VM, container, or IOMMU boundary is crossed.\nC:H - The unterminated string is read until an arbitrary in-memory NUL, so the length is determined by heap contents rather than by any bound: the over-read spills into `total_segments`/`start_blk`/`end_blk`, into `nr_blkz` and the `blkz_seq` kernel heap pointer on zoned devices, and past the end of the `kzalloc`\u0027d `f2fs_dev_info` array at its last element. Those bytes are printed verbatim into dmesg and exported through the world-readable 0444 `/proc/fs/f2fs/\u003cdev\u003e/disk_map`, so adjacent slab data and a kernel heap pointer (defeating KASLR) are disclosed to unprivileged userspace and can be re-read at will.\nI:L - The mis-parsed string is handed to `bdev_file_open_by_path()`, so f2fs can attach to and write filesystem data onto a block device whose path exceeds the 64-byte on-disk field \u2014 a target the format otherwise cannot name \u2014 corrupting that device\u0027s contents. There is no out-of-bounds write or attacker-controlled store, so the modification is limited rather than arbitrary.\nA:H - The strlen/vsnprintf walk past the end of the slab object faults hard on hardened configurations (KFENCE guard page, `panic_on_warn` with a KASAN slab-out-of-bounds report) and can read into unmapped memory at a slab-page boundary, oopsing the mounting task. Even without a fault, the mis-parsed device path aborts the mount with \"Failed to find devices\", leaving the volume \u2014 typically the device\u0027s primary Android/SD-card storage \u2014 unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:40.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cf1ff15f262e8baf12201b270b6a79f9d119b2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/666b7cf6ac9aa074b8319a2b68cba7f2c30023f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3466721f06edff834f99d9f49f23eabc6b2cb78e"
        },
        {
          "url": "https://git.kernel.org/stable/c/345fc8d1838f3f8be7c8ed08d86a13dedef67136"
        },
        {
          "url": "https://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/755427093e4294ac111c3f9e40d53f681a0fbdaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b1efa5f0e878745e94a98022e8edc675a87d78e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5661998536af52848cc4d52a377e90368196edea"
        }
      ],
      "title": "f2fs: fix to avoid out-of-boundary access in devs.path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38652",
    "datePublished": "2025-08-22T16:00:56.445Z",
    "dateReserved": "2025-04-16T04:51:24.030Z",
    "dateUpdated": "2026-08-05T12:03:40.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted