Vulnerability-Lookup

GHSA-6X6V-877J-V9FV

Vulnerability from github – Published: 2025-08-19 18:31 – Updated: 2026-01-09 15:30

Details

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix KMSAN uninit-value in extent_info usage

KMSAN reported a use of uninitialized value in __is_extent_mergeable() and __is_back_mergeable() via the read extent tree path.

The root cause is that get_read_extent_info() only initializes three fields (fofs, blk, len) of struct extent_info, leaving the remaining fields uninitialized. This leads to undefined behavior when those fields are accessed later, especially during extent merging.

Fix it by zero-initializing the extent_info struct before population.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-38579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-19T17:15:35Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix KMSAN uninit-value in extent_info usage\n\nKMSAN reported a use of uninitialized value in `__is_extent_mergeable()`\n and `__is_back_mergeable()` via the read extent tree path.\n\nThe root cause is that `get_read_extent_info()` only initializes three\nfields (`fofs`, `blk`, `len`) of `struct extent_info`, leaving the\nremaining fields uninitialized. This leads to undefined behavior\nwhen those fields are accessed later, especially during\nextent merging.\n\nFix it by zero-initializing the `extent_info` struct before population.",
  "id": "GHSA-6x6v-877j-v9fv",
  "modified": "2026-01-09T15:30:22Z",
  "published": "2025-08-19T18:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-38579"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/01b6f5955e0008af6bc3a181310d2744bb349800"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/08e8ab00a6d20d5544c932ee85a297d833895141"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/154467f4ad033473e5c903a03e7b9bca7df9a0fa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/44a79437309e0ee2276ac17aaedc71253af253a8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cc1615d5aba4f396cf412579928539a2b124c8a0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dabfa3952c8e6bfe6414dbf32e8b6c5f349dc898"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e68b751ec2b15d866967812c57cfdfc1eba6a269"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-38579 (GCVE-0-2025-38579)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:03 – Updated: 2026-08-05 12:03

Title

f2fs: fix KMSAN uninit-value in extent_info usage

Summary

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix KMSAN uninit-value in extent_info usage KMSAN reported a use of uninitialized value in `__is_extent_mergeable()` and `__is_back_mergeable()` via the read extent tree path. The root cause is that `get_read_extent_info()` only initializes three fields (`fofs`, `blk`, `len`) of `struct extent_info`, leaving the remaining fields uninitialized. This leads to undefined behavior when those fields are accessed later, especially during extent merging. Fix it by zero-initializing the `extent_info` struct before population.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/08e8ab00a6d20d554…
https://git.kernel.org/stable/c/e68b751ec2b15d866…
https://git.kernel.org/stable/c/dabfa3952c8e6bfe6…
https://git.kernel.org/stable/c/44a79437309e0ee22…
https://git.kernel.org/stable/c/cc1615d5aba4f396c…
https://git.kernel.org/stable/c/01b6f5955e0008af6…
https://git.kernel.org/stable/c/154467f4ad033473e…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 94afd6d6e5253179c9b891d02081cc8355a11768 , < 08e8ab00a6d20d5544c932ee85a297d833895141 (git) Affected: 94afd6d6e5253179c9b891d02081cc8355a11768 , < e68b751ec2b15d866967812c57cfdfc1eba6a269 (git) Affected: 94afd6d6e5253179c9b891d02081cc8355a11768 , < dabfa3952c8e6bfe6414dbf32e8b6c5f349dc898 (git) Affected: 94afd6d6e5253179c9b891d02081cc8355a11768 , < 44a79437309e0ee2276ac17aaedc71253af253a8 (git) Affected: 94afd6d6e5253179c9b891d02081cc8355a11768 , < cc1615d5aba4f396cf412579928539a2b124c8a0 (git) Affected: 94afd6d6e5253179c9b891d02081cc8355a11768 , < 01b6f5955e0008af6bc3a181310d2744bb349800 (git) Affected: 94afd6d6e5253179c9b891d02081cc8355a11768 , < 154467f4ad033473e5c903a03e7b9bca7df9a0fa (git)
Linux	Linux	Affected: 5.15 Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.190 , ≤ 5.15.* (semver) Unaffected: 6.1.148 , ≤ 6.1.* (semver) Unaffected: 6.6.102 , ≤ 6.6.* (semver) Unaffected: 6.12.42 , ≤ 6.12.* (semver) Unaffected: 6.15.10 , ≤ 6.15.* (semver) Unaffected: 6.16.1 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:08.639Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/extent_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "08e8ab00a6d20d5544c932ee85a297d833895141",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "e68b751ec2b15d866967812c57cfdfc1eba6a269",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "dabfa3952c8e6bfe6414dbf32e8b6c5f349dc898",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "44a79437309e0ee2276ac17aaedc71253af253a8",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "cc1615d5aba4f396cf412579928539a2b124c8a0",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "01b6f5955e0008af6bc3a181310d2744bb349800",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            },
            {
              "lessThan": "154467f4ad033473e5c903a03e7b9bca7df9a0fa",
              "status": "affected",
              "version": "94afd6d6e5253179c9b891d02081cc8355a11768",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/extent_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix KMSAN uninit-value in extent_info usage\n\nKMSAN reported a use of uninitialized value in `__is_extent_mergeable()`\n and `__is_back_mergeable()` via the read extent tree path.\n\nThe root cause is that `get_read_extent_info()` only initializes three\nfields (`fofs`, `blk`, `len`) of `struct extent_info`, leaving the\nremaining fields uninitialized. This leads to undefined behavior\nwhen those fields are accessed later, especially during\nextent merging.\n\nFix it by zero-initializing the `extent_info` struct before population."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - f2fs is a local block-device filesystem; the uninitialized `extent_info` is consumed in `do_read_inode()`/`f2fs_init_read_extent_tree()`, reached by ordinary local file access (open/stat/read) on a mounted f2fs volume or by mounting a crafted image. There is no network-facing consumer of this code path.\nAC:L - The defect is deterministic \u2014 every regular-file inode loaded on an f2fs mount with the default read extent cache runs `get_read_extent_info()` over a stack-resident `struct extent_info` whose union bytes are never written, and the attacker both grooms the kernel stack (a preceding syscall leaves chosen values at that frame depth) and triggers the read at will. No race and no condition outside the attacker\u0027s control.\nPR:L - Any unprivileged local user who can open a file on an f2fs filesystem reaches `f2fs_iget()`\u2192`do_read_inode()`\u2192`f2fs_init_read_extent_tree()`; no capability, no CAP_SYS_ADMIN and no mount privilege is checked on this path. f2fs is the default userdata filesystem on Android and is common on embedded/IoT rootfs, so unprivileged app access suffices.\nUI:N - No victim action is required \u2014 the filesystem is already mounted in the normal deployment, and the attacker triggers the uninitialized read itself by touching any regular file. Nothing must be opened, plugged in, or mounted by another user.\nS:U - The uninitialized data stays inside the kernel\u0027s own extent cache and page cache within the same security authority; no VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Uninitialized kernel stack bytes are persisted into the long-lived extent tree (`en-\u003eei`, `et-\u003elargest`) and are printed verbatim to the kernel log by `f2fs_err_ratelimited()` in `__insert_extent_tree()`, which formats `ei.age`/`ei.last_blocks` \u2014 direct aliases of the never-written union bytes, potentially containing kernel pointers or residual data. Worse, a garbage `c_len` corrupts the `__is_extent_mergeable()` decision so an extent\u0027s file-offset\u2192block mapping becomes wrong, causing `f2fs_read_multi_pages()` to fetch and decompress unrelated on-disk blocks (`ei.blk + i - 1`) into this file\u0027s page cache, disclosing other files\u0027 data to the reader.\nI:H - The corrupted merge decision and the bogus `nr_cpages` bound derived from the uninitialized `c_len` make the compressed read path read the wrong physical blocks and decompress them into the inode\u0027s page cache, so applications silently observe corrupted file contents; the same paths set `SBI_NEED_FSCK` and `FI_COMPRESS_CORRUPT`, corrupting filesystem state that later writeback and fsck act on.\nA:H - Over-long/overlapping extents produced by the bad merge reach the corrupted-extent branch of `__insert_extent_tree()`, which calls `f2fs_bug_on(sbi, 1)` \u2014 a hard `BUG_ON()` panic with `CONFIG_F2FS_CHECK_FS` and a `WARN_ON()` (panic under `panic_on_warn`) otherwise \u2014 and the mismatched compressed-block count trips `f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION)` with `-EFSCORRUPTED`/EIO, denying access to file data."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:06.641Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/08e8ab00a6d20d5544c932ee85a297d833895141"
        },
        {
          "url": "https://git.kernel.org/stable/c/e68b751ec2b15d866967812c57cfdfc1eba6a269"
        },
        {
          "url": "https://git.kernel.org/stable/c/dabfa3952c8e6bfe6414dbf32e8b6c5f349dc898"
        },
        {
          "url": "https://git.kernel.org/stable/c/44a79437309e0ee2276ac17aaedc71253af253a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc1615d5aba4f396cf412579928539a2b124c8a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/01b6f5955e0008af6bc3a181310d2744bb349800"
        },
        {
          "url": "https://git.kernel.org/stable/c/154467f4ad033473e5c903a03e7b9bca7df9a0fa"
        }
      ],
      "title": "f2fs: fix KMSAN uninit-value in extent_info usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38579",
    "datePublished": "2025-08-19T17:03:02.308Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2026-08-05T12:03:06.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.