Security readout for executives and security teams
Plain-English summary
A Linux Btrfs flaw can cause invalid kernel memory access while replaying a filesystem log. Successful exploitation requires local, low-privileged access according to the supplied CVSS data, so this is not documented as a direct remote entry point. Consequences are rated severe for confidentiality, integrity, and availability, although the bundle does not establish a specific exploitation outcome.
Executive priority
Treat this as a high-priority kernel maintenance issue for Btrfs systems, especially multi-user hosts and platforms running untrusted local workloads. It does not warrant remote-exploitation emergency handling based on current evidence. Accelerate normal patching, confirm successful reboot into the corrected kernel, and document any systems deferred because of operational constraints.
Technical view
During Btrfs log replay, __inode_add_ref() can jump to its next processing label before victim_name.len is initialized. The following extended-reference iteration then uses an undefined length, causing invalid memory access. The published fix initializes the field from the current extended reference's name length.
Likely exposure
Exposure is most likely on systems running affected Linux kernel builds and using Btrfs where log replay processes extended references. The supplied version data contains unusual and duplicated entries, while distributions may backport fixes. Validate the running distribution package against vendor advisories or referenced fix commits rather than relying only on upstream version numbers.
Exploitation context
No active exploitation is established by the supplied sources, and the bundle marks the CVE as absent from KEV. The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. No public exploit, attack chain, or confirmed real-world compromise is identified in the evidence provided.
Researcher notes
The root cause is an uninitialized length used across an extended-reference iteration during Btrfs log replay. No CWE is supplied. Multiple stable-kernel fix references are listed, but the affected-version representation is not sufficiently clear for definitive package-level conclusions. The evidence establishes invalid memory access and a high CVSS rating, not a demonstrated exploitation primitive.
Mitigation direction
- Apply a distribution-supported kernel update incorporating the referenced upstream Btrfs fix.
- Prioritize Btrfs hosts that permit untrusted local users or workloads.
- If updates are delayed, follow vendor guidance and reduce untrusted local access to affected Btrfs hosts.
Validation and detection
- Inventory running kernel builds and identify systems with mounted Btrfs filesystems.
- Check distribution advisories or package changelogs for this CVE or a referenced stable commit.
- Reboot updated systems and confirm the fixed kernel package is actively running.
- Review kernel logs for Btrfs errors, oopses, or memory-access failures associated with log replay.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38382 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/539969fc472886a1d63565459514d47e27fef461CVE reference, Linux
- https://git.kernel.org/stable/c/2d11d274e2e1d7c79e2ca8461ce3ff3a95c11171CVE reference, Linux
- https://git.kernel.org/stable/c/7ac790dc2ba00499a8d671d4a24de4d4ad27e234CVE reference, Linux
- https://git.kernel.org/stable/c/aee57a0293dca675637e5504709f9f8fd8e871beCVE reference, Linux
- https://git.kernel.org/stable/c/54a7081ed168b72a8a2d6ef4ba3a1259705a2926CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.