Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s OCFS2 filesystem handling can let malformed metadata from a corrupted mounted disk cause kernel memory access outside expected bounds. A successful trigger could affect system confidentiality, integrity, or availability. Risk is concentrated on Linux systems using OCFS2, not ordinary network exposure.
Executive priority
Prioritize prompt remediation on production, clustered-storage, or sensitive hosts using OCFS2. Treat non-OCFS2 systems as lower priority after confirming the filesystem is neither mounted nor operationally available. Coordinate kernel updates through normal maintenance and reboot procedures.
Technical view
OCFS2 accepted the 16-bit l_tree_depth value without ensuring it stayed within OCFS2_MAX_PATH_DEPTH. Invalid on-disk metadata could therefore cause out-of-bounds kernel access. The supplied CVSS 3.1 assessment is 7.8, with a local, low-complexity, low-privilege vector requiring no user interaction.
Likely exposure
Exposure is most likely where affected Linux kernels mount OCFS2 filesystems, particularly disks or images that may be corrupted or untrusted. Systems not using OCFS2 are unlikely to expose the vulnerable path. The supplied version list is broad, so distribution-specific package status should determine applicability.
Exploitation context
The source bundle does not identify active exploitation, and the CVE is not listed as KEV. It also provides no evidence of a public exploit. The issue requires local interaction with a mounted OCFS2 filesystem rather than direct remote network access.
Researcher notes
The correction validates l_tree_depth before path traversal. Assess backported fixes by package changelog or commit inclusion rather than version strings alone. The supplied affected data contains broad version entries and repeated commit identifiers, limiting precise branch-level conclusions without distribution guidance.
Mitigation direction
- Inventory Linux hosts that load or mount OCFS2 filesystems.
- Apply the distribution kernel update containing the applicable upstream stable validation fix.
- Until patched, avoid mounting untrusted or suspected-corrupt OCFS2 disks and images.
- Restrict local access and filesystem mount administration on affected hosts.
Validation and detection
- Confirm whether OCFS2 is enabled, loaded, or mounted on each Linux host.
- Compare the running kernel package against vendor advisories and the cited stable fixes.
- Verify the patched kernel is running after reboot, not merely installed.
- Review kernel logs for OCFS2 errors or crashes associated with corrupted media.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22079 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ef34840bda333fe99bafbd2d73b70ceaaf9eba66CVE reference, Linux
- https://git.kernel.org/stable/c/538ed8b049ef801a86c543433e5061a91cc106e3CVE reference, Linux
- https://git.kernel.org/stable/c/17c99ab3db2ba74096d36c69daa6e784e98fc0b8CVE reference, Linux
- https://git.kernel.org/stable/c/11e24802e73362aa2948ee16b8fb4e32635d5b2aCVE reference, Linux
- https://git.kernel.org/stable/c/3d012ba4404a0bb517658699ba85e6abda386dc3CVE reference, Linux
- https://git.kernel.org/stable/c/49d2a2ea9d30991bae82107f9523915b91637683CVE reference, Linux
- https://git.kernel.org/stable/c/b942f88fe7d2d789e51c5c30a675fa1c126f5a6dCVE reference, Linux
- https://git.kernel.org/stable/c/e95d97c9c8cd0c239b7b59c79be0f6a9dcf7905cCVE reference, Linux
- https://git.kernel.org/stable/c/a406aff8c05115119127c962cbbbbd202e1973efCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.