{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38579", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.026Z", "datePublished": "2025-08-19T17:03:02.308Z", "dateUpdated": "2026-08-05T12:03:06.641Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:03:06.641Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix KMSAN uninit-value in extent_info usage\n\nKMSAN reported a use of uninitialized value in `__is_extent_mergeable()`\n and `__is_back_mergeable()` via the read extent tree path.\n\nThe root cause is that `get_read_extent_info()` only initializes three\nfields (`fofs`, `blk`, `len`) of `struct extent_info`, leaving the\nremaining fields uninitialized. This leads to undefined behavior\nwhen those fields are accessed later, especially during\nextent merging.\n\nFix it by zero-initializing the `extent_info` struct before population." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - f2fs is a local block-device filesystem; the uninitialized `extent_info` is consumed in `do_read_inode()`/`f2fs_init_read_extent_tree()`, reached by ordinary local file access (open/stat/read) on a mounted f2fs volume or by mounting a crafted image. There is no network-facing consumer of this code path.\nAC:L - The defect is deterministic — every regular-file inode loaded on an f2fs mount with the default read extent cache runs `get_read_extent_info()` over a stack-resident `struct extent_info` whose union bytes are never written, and the attacker both grooms the kernel stack (a preceding syscall leaves chosen values at that frame depth) and triggers the read at will. No race and no condition outside the attacker's control.\nPR:L - Any unprivileged local user who can open a file on an f2fs filesystem reaches `f2fs_iget()`→`do_read_inode()`→`f2fs_init_read_extent_tree()`; no capability, no CAP_SYS_ADMIN and no mount privilege is checked on this path. f2fs is the default userdata filesystem on Android and is common on embedded/IoT rootfs, so unprivileged app access suffices.\nUI:N - No victim action is required — the filesystem is already mounted in the normal deployment, and the attacker triggers the uninitialized read itself by touching any regular file. Nothing must be opened, plugged in, or mounted by another user.\nS:U - The uninitialized data stays inside the kernel's own extent cache and page cache within the same security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Uninitialized kernel stack bytes are persisted into the long-lived extent tree (`en->ei`, `et->largest`) and are printed verbatim to the kernel log by `f2fs_err_ratelimited()` in `__insert_extent_tree()`, which formats `ei.age`/`ei.last_blocks` — direct aliases of the never-written union bytes, potentially containing kernel pointers or residual data. Worse, a garbage `c_len` corrupts the `__is_extent_mergeable()` decision so an extent's file-offset→block mapping becomes wrong, causing `f2fs_read_multi_pages()` to fetch and decompress unrelated on-disk blocks (`ei.blk + i - 1`) into this file's page cache, disclosing other files' data to the reader.\nI:H - The corrupted merge decision and the bogus `nr_cpages` bound derived from the uninitialized `c_len` make the compressed read path read the wrong physical blocks and decompress them into the inode's page cache, so applications silently observe corrupted file contents; the same paths set `SBI_NEED_FSCK` and `FI_COMPRESS_CORRUPT`, corrupting filesystem state that later writeback and fsck act on.\nA:H - Over-long/overlapping extents produced by the bad merge reach the corrupted-extent branch of `__insert_extent_tree()`, which calls `f2fs_bug_on(sbi, 1)` — a hard `BUG_ON()` panic with `CONFIG_F2FS_CHECK_FS` and a `WARN_ON()` (panic under `panic_on_warn`) otherwise — and the mismatched compressed-block count trips `f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION)` with `-EFSCORRUPTED`/EIO, denying access to file data." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/extent_cache.c" ], "versions": [ { "version": "94afd6d6e5253179c9b891d02081cc8355a11768", "lessThan": "08e8ab00a6d20d5544c932ee85a297d833895141", "status": "affected", "versionType": "git" }, { "version": "94afd6d6e5253179c9b891d02081cc8355a11768", "lessThan": "e68b751ec2b15d866967812c57cfdfc1eba6a269", "status": "affected", "versionType": "git" }, { "version": "94afd6d6e5253179c9b891d02081cc8355a11768", "lessThan": "dabfa3952c8e6bfe6414dbf32e8b6c5f349dc898", "status": "affected", "versionType": "git" }, { "version": "94afd6d6e5253179c9b891d02081cc8355a11768", "lessThan": "44a79437309e0ee2276ac17aaedc71253af253a8", "status": "affected", "versionType": "git" }, { "version": "94afd6d6e5253179c9b891d02081cc8355a11768", "lessThan": "cc1615d5aba4f396cf412579928539a2b124c8a0", "status": "affected", "versionType": "git" }, { "version": "94afd6d6e5253179c9b891d02081cc8355a11768", "lessThan": "01b6f5955e0008af6bc3a181310d2744bb349800", "status": "affected", "versionType": "git" }, { "version": "94afd6d6e5253179c9b891d02081cc8355a11768", "lessThan": "154467f4ad033473e5c903a03e7b9bca7df9a0fa", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/f2fs/extent_cache.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.148", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.102", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.42", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.10", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.1", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.190" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.102" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.15.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.16.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/08e8ab00a6d20d5544c932ee85a297d833895141" }, { "url": "https://git.kernel.org/stable/c/e68b751ec2b15d866967812c57cfdfc1eba6a269" }, { "url": "https://git.kernel.org/stable/c/dabfa3952c8e6bfe6414dbf32e8b6c5f349dc898" }, { "url": "https://git.kernel.org/stable/c/44a79437309e0ee2276ac17aaedc71253af253a8" }, { "url": "https://git.kernel.org/stable/c/cc1615d5aba4f396cf412579928539a2b124c8a0" }, { "url": "https://git.kernel.org/stable/c/01b6f5955e0008af6bc3a181310d2744bb349800" }, { "url": "https://git.kernel.org/stable/c/154467f4ad033473e5c903a03e7b9bca7df9a0fa" } ], "title": "f2fs: fix KMSAN uninit-value in extent_info usage", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:40:08.639Z" } } ] } }