PT-2025-35983 · Linux +1 · Linux Kernel +1

Published 2025-09-04 · Updated 2025-09-04 · CVE-2025-38710

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions:

Linux kernel (affected versions not specified)

Description:

A flaw exists in the Linux kernel related to the validation of `i depth` for exhash directories within the gfs2 filesystem. A fuzzer test revealed corruption leading to a depth of 0 in `dir e read()`, causing an undefined shift operation. The minimum depth for an exhash directory is determined by `ilog2(sdp->sd hash ptrs)`, and a depth of 0 is invalid. The issue arises from an undefined shift by 32 at `index = hash >> (32 - dip->i depth)`. The calculation in `dir make exhash()` has been modified to use `ilog2()` for clarity.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-38710

Affected Products

Debian

Linux Kernel

References · 10

• https://security-tracker.debian.org/tracker/source-package/linux · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-38710 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38710 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-38710 · Vendor Advisory
• https://git.kernel.org/stable/c/557c024ca7250bb65ae60f16c02074106c2f197b · Note
• https://git.kernel.org/stable/c/b5f46951e62377b6e406fadc18bc3c5bdf1632a7 · Note
• https://git.kernel.org/stable/c/53a0249d68a210c16e961b83adfa82f94ee0a53d · Note
• https://git.kernel.org/stable/c/9680c58675b82348ab84d387e4fa727f7587e1a0 · Note
• https://packages.debian.org/src:linux · Note
• https://twitter.com/CVEnew/status/1963637918574190790 · Twitter Post