CVE-2025-38710

Vulnerability

Overview

CVE-2025-38710 is a medium-severity vulnerability in the Linux kernel's GFS2 (Global File System) file system driver, specifically affecting the handling of exhash directories. The issue arises from insufficient validation of the i_depth field in directory inodes. When an exhash directory has an invalid depth of 0, the function dir_e_read() computes an index using the expression hash >> (32 - i_depth), which results in an undefined shift by 32 bits, triggering undefined behavior [1][2].

Exploitation and

Root Cause

The root cause is that the minimum allowed depth for an exhash directory—calculated as ilog2(sdp->sd_hash_ptrs), where sdp->sd_hash_ptrs equals the block size divided by 16—was not enforced during inode loading. While the kernel already checked for depths exceeding a maximum value, depths below the minimum were allowed, leaving a window for corruption or malicious input. A fuzzer discovered this vulnerability by introducing corrupted on-disk data with a depth of 0 [1].

Impact

An attacker with the ability to mount a crafted GFS2 file system could trigger this undefined behavior, potentially leading to a system crash or other unpredictable outcomes. The vulnerability is rated with a CVSS v3 score of 5.5 (Medium) and requires local access or the ability to introduce malformed file system metadata to exploit [1][2].

Mitigation and

Status

The fix has been applied to the Linux kernel stable tree in commits identifying and validating that the depth of an exhash directory is at least the minimum calculated value during gfs2_dinode_in(). The patch also clarifies the depth calculation in dir_make_exhash() by using ilog2(). Users should update their kernel to a version that includes the fix to eliminate the potential for undefined behavior [1][2].