CVE-2025-38415
BaseFortify
Publication date: 2025-07-25
Last updated on: 2025-11-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's Squashfs filesystem code. When multiple processes simultaneously mount a Squashfs filesystem and issue an ioctl call to set the block size on /dev/loop0, a race condition can cause the function sb_min_blocksize() to return 0. This leads to an invalid calculation in the code, resulting in an out-of-bounds shift operation (shift exponent 64 on a 64-bit type), which triggers an undefined behavior sanitizer (UBSAN) error. The issue arises because the code does not properly check for a zero return value from sb_min_blocksize(), causing incorrect internal state and potential kernel instability.
How can this vulnerability impact me? :
This vulnerability can cause kernel instability or crashes when mounting Squashfs filesystems under specific concurrent conditions. The out-of-bounds shift operation can lead to undefined behavior, potentially causing denial of service or system crashes. This may affect system reliability and availability, especially in environments where Squashfs filesystems are frequently mounted concurrently.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix which adds a check for a 0 return by sb_min_blocksize() in the Squashfs filesystem code. Avoid mounting Squashfs filesystems on /dev/loop0 concurrently with ioctl calls that set block size, as this triggers the issue.