Security readout for executives and security teams
Plain-English summary
A corrupted ext4 filesystem can make the Linux kernel read beyond an allocated directory block when a malformed directory is removed. Triggering requires the filesystem to be mounted and the affected directory processed, so this is primarily a local or unsafe-filesystem-ingestion risk rather than a direct network attack.
Executive priority
Handle within the normal high-severity kernel patch cycle, accelerating remediation where systems mount externally supplied or potentially corrupted filesystems. The local trigger reduces broad internet exposure, but kernel-level memory access and the supplied CVSS 7.8 assessment justify timely action.
Technical view
ext4_empty_dir() trusts the '.' entry's record length when locating '..'. A record length equal to the 4 KB block size passes existing checks, leaving the next-entry pointer immediately outside the block. Dereferencing it causes an out-of-bounds read. The fix rejects real '.' entries extending to the block boundary while excluding checksum pseudo-entries.
Likely exposure
Systems running an unfixed Linux kernel with ext4 support are potentially exposed when they mount corrupted or attacker-influenced ext4 filesystems. The supplied data covers multiple stable branches, but its flattened version list is insufficient for exact per-build conclusions. Distribution and appliance kernel builds require vendor-specific verification.
Exploitation context
The supplied record does not list this CVE in KEV and provides no evidence of active exploitation or a public exploit. Syzkaller discovered the flaw, and KASAN reproduced the invalid memory access. Absence of reported exploitation does not prove exploitation has never occurred.
Researcher notes
Syzkaller found the issue. KASAN may report it as slab use-after-free when adjacent memory was recently freed, but the kernel analysis identifies the root cause as an out-of-bounds read. Confirm backports by checking the __ext4_check_dir_entry() boundary validation, not version numbers alone.
Mitigation direction
- Update affected Linux kernels to a vendor-supported build containing the referenced ext4 fix.
- Until updated, avoid mounting untrusted or corrupted ext4 filesystems and disk images.
- Consult Linux distribution or appliance vendor advisories for branch-specific fixed versions.
Validation and detection
- Inventory systems using ext4 and record each running kernel version and vendor build.
- Compare each build with vendor guidance and stable-branch fix commits referenced by the CVE.
- Identify services or administrators that can mount externally supplied ext4 media or images.
- After updating, confirm the active kernel changed and the vendor marks the build fixed.
- Review kernel logs for ext4 errors, memory-safety reports, or crashes around directory removal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37785 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/14da7dbecb430e35b5889da8dae7bef33173b351CVE reference, Linux
- https://git.kernel.org/stable/c/e47f472a664d70a3d104a6c2a035cdff55a719b4CVE reference, Linux
- https://git.kernel.org/stable/c/b7531a4f99c3887439d778afaf418d1a01a5f01bCVE reference, Linux
- https://git.kernel.org/stable/c/89503e5eae64637d0fa2218912b54660effe7d93CVE reference, Linux
- https://git.kernel.org/stable/c/52a5509ab19a5d3afe301165d9b5787bba34d842CVE reference, Linux
- https://git.kernel.org/stable/c/b47584c556444cf7acb66b26a62cbc348eb92b78CVE reference, Linux
- https://git.kernel.org/stable/c/ac28c5684c1cdab650a7e5065b19e91577d37a4bCVE reference, Linux
- https://git.kernel.org/stable/c/53bc45da8d8da92ec07877f5922b130562eb4b00CVE reference, Linux
- https://git.kernel.org/stable/c/d5e206778e96e8667d3bde695ad372c296dc9353CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.