CVE-2025-38579 (GCVE-0-2025-38579)
Vulnerability from cvelistv5
Published
2025-08-19 17:03
Modified
2026-08-05 12:03
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix KMSAN uninit-value in extent_info usage KMSAN reported a use of uninitialized value in `__is_extent_mergeable()` and `__is_back_mergeable()` via the read extent tree path. The root cause is that `get_read_extent_info()` only initializes three fields (`fofs`, `blk`, `len`) of `struct extent_info`, leaving the remaining fields uninitialized. This leads to undefined behavior when those fields are accessed later, especially during extent merging. Fix it by zero-initializing the `extent_info` struct before population.
References
Impacted products
Vendor Product Version
Linux Linux Version: 94afd6d6e5253179c9b891d02081cc8355a11768
Version: 94afd6d6e5253179c9b891d02081cc8355a11768
Version: 94afd6d6e5253179c9b891d02081cc8355a11768
Version: 94afd6d6e5253179c9b891d02081cc8355a11768
Version: 94afd6d6e5253179c9b891d02081cc8355a11768
Version: 94afd6d6e5253179c9b891d02081cc8355a11768
Version: 94afd6d6e5253179c9b891d02081cc8355a11768
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:08.639Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/extent_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "08e8ab00a6d20d5544c932ee85a297d833895141",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "e68b751ec2b15d866967812c57cfdfc1eba6a269",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "dabfa3952c8e6bfe6414dbf32e8b6c5f349dc898",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "44a79437309e0ee2276ac17aaedc71253af253a8",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "cc1615d5aba4f396cf412579928539a2b124c8a0",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "01b6f5955e0008af6bc3a181310d2744bb349800",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "154467f4ad033473e5c903a03e7b9bca7df9a0fa",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/extent_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix KMSAN uninit-value in extent_info usage\n\nKMSAN reported a use of uninitialized value in `__is_extent_mergeable()`\n and `__is_back_mergeable()` via the read extent tree path.\n\nThe root cause is that `get_read_extent_info()` only initializes three\nfields (`fofs`, `blk`, `len`) of `struct extent_info`, leaving the\nremaining fields uninitialized. This leads to undefined behavior\nwhen those fields are accessed later, especially during\nextent merging.\n\nFix it by zero-initializing the `extent_info` struct before population."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - f2fs is a local block-device filesystem; the uninitialized `extent_info` is consumed in `do_read_inode()`/`f2fs_init_read_extent_tree()`, reached by ordinary local file access (open/stat/read) on a mounted f2fs volume or by mounting a crafted image. There is no network-facing consumer of this code path.\nAC:L - The defect is deterministic \u2014 every regular-file inode loaded on an f2fs mount with the default read extent cache runs `get_read_extent_info()` over a stack-resident `struct extent_info` whose union bytes are never written, and the attacker both grooms the kernel stack (a preceding syscall leaves chosen values at that frame depth) and triggers the read at will. No race and no condition outside the attacker\u0027s control.\nPR:L - Any unprivileged local user who can open a file on an f2fs filesystem reaches `f2fs_iget()`\u2192`do_read_inode()`\u2192`f2fs_init_read_extent_tree()`; no capability, no CAP_SYS_ADMIN and no mount privilege is checked on this path. f2fs is the default userdata filesystem on Android and is common on embedded/IoT rootfs, so unprivileged app access suffices.\nUI:N - No victim action is required \u2014 the filesystem is already mounted in the normal deployment, and the attacker triggers the uninitialized read itself by touching any regular file. Nothing must be opened, plugged in, or mounted by another user.\nS:U - The uninitialized data stays inside the kernel\u0027s own extent cache and page cache within the same security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Uninitialized kernel stack bytes are persisted into the long-lived extent tree (`en-\u003eei`, `et-\u003elargest`) and are printed verbatim to the kernel log by `f2fs_err_ratelimited()` in `__insert_extent_tree()`, which formats `ei.age`/`ei.last_blocks` \u2014 direct aliases of the never-written union bytes, potentially containing kernel pointers or residual data. Worse, a garbage `c_len` corrupts the `__is_extent_mergeable()` decision so an extent\u0027s file-offset\u2192block mapping becomes wrong, causing `f2fs_read_multi_pages()` to fetch and decompress unrelated on-disk blocks (`ei.blk + i - 1`) into this file\u0027s page cache, disclosing other files\u0027 data to the reader.\nI:H - The corrupted merge decision and the bogus `nr_cpages` bound derived from the uninitialized `c_len` make the compressed read path read the wrong physical blocks and decompress them into the inode\u0027s page cache, so applications silently observe corrupted file contents; the same paths set `SBI_NEED_FSCK` and `FI_COMPRESS_CORRUPT`, corrupting filesystem state that later writeback and fsck act on.\nA:H - Over-long/overlapping extents produced by the bad merge reach the corrupted-extent branch of `__insert_extent_tree()`, which calls `f2fs_bug_on(sbi, 1)` \u2014 a hard `BUG_ON()` panic with `CONFIG_F2FS_CHECK_FS` and a `WARN_ON()` (panic under `panic_on_warn`) otherwise \u2014 and the mismatched compressed-block count trips `f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION)` with `-EFSCORRUPTED`/EIO, denying access to file data."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:06.641Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/08e8ab00a6d20d5544c932ee85a297d833895141"
        },
        {
          "url": "https://git.kernel.org/stable/c/e68b751ec2b15d866967812c57cfdfc1eba6a269"
        },
        {
          "url": "https://git.kernel.org/stable/c/dabfa3952c8e6bfe6414dbf32e8b6c5f349dc898"
        },
        {
          "url": "https://git.kernel.org/stable/c/44a79437309e0ee2276ac17aaedc71253af253a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc1615d5aba4f396cf412579928539a2b124c8a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/01b6f5955e0008af6bc3a181310d2744bb349800"
        },
        {
          "url": "https://git.kernel.org/stable/c/154467f4ad033473e5c903a03e7b9bca7df9a0fa"
        }
      ],
      "title": "f2fs: fix KMSAN uninit-value in extent_info usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38579",
    "datePublished": "2025-08-19T17:03:02.308Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2026-08-05T12:03:06.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.