Security readout for executives and security teams
Plain-English summary
A Linux F2FS filesystem flaw can cause the kernel to use uninitialized data while merging file extents. This creates undefined behavior that may threaten confidentiality, integrity, or availability. The supplied score is 7.8, but exploitation requires local, low-privileged access and affected F2FS code paths.
Executive priority
Treat this as a high-priority kernel maintenance issue for F2FS systems, especially multi-user or locally accessible hosts. It is not supported as an emergency internet-wide exploitation event. Confirm exposure quickly, then apply the distribution-approved fixed kernel through normal expedited patching processes.
Technical view
get_read_extent_info() populated only fofs, blk, and len in struct extent_info. Other fields remained uninitialized and could be read by __is_extent_mergeable() or __is_back_mergeable() during read-extent merging. The upstream correction zero-initializes the structure before populating it. KMSAN detected the defect.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel and using F2FS sufficiently to reach read-extent merging. The bundle lists affected releases across the 5.15 through 6.17 lines, but administrators should use their distribution’s advisory to determine exact vulnerable and fixed package versions.
Exploitation context
The CVSS vector describes a local attack requiring low privileges, with no user interaction. The supplied bundle marks this CVE as absent from KEV, and provides no evidence of active exploitation, a public exploit, or reliable practical impact. Internet exposure alone does not establish vulnerability.
Researcher notes
The evidence establishes an uninitialized-value read and an upstream zero-initialization fix. No CWE is supplied. The CVSS assessment claims high confidentiality, integrity, and availability impact, but the bundle does not document a demonstrated exploitation path, crash, privilege escalation, data corruption, or information disclosure. Exact branch boundaries should be verified from vendor records.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream fix.
- Check distribution guidance for exact fixed package versions and reboot requirements.
- Prioritize affected systems that use F2FS and permit untrusted local access.
- Schedule prompt remediation where confidentiality, integrity, or availability requirements are high.
Validation and detection
- Inventory kernel versions and identify systems with mounted or configured F2FS filesystems.
- Compare installed kernel packages against the relevant vendor advisory or linked stable fix.
- After updating and rebooting, confirm the running kernel is the intended fixed build.
- In safe testing, verify instrumented kernels no longer report this KMSAN finding.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38579 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/08e8ab00a6d20d5544c932ee85a297d833895141CVE reference, Linux
- https://git.kernel.org/stable/c/e68b751ec2b15d866967812c57cfdfc1eba6a269CVE reference, Linux
- https://git.kernel.org/stable/c/dabfa3952c8e6bfe6414dbf32e8b6c5f349dc898CVE reference, Linux
- https://git.kernel.org/stable/c/44a79437309e0ee2276ac17aaedc71253af253a8CVE reference, Linux
- https://git.kernel.org/stable/c/cc1615d5aba4f396cf412579928539a2b124c8a0CVE reference, Linux
- https://git.kernel.org/stable/c/01b6f5955e0008af6bc3a181310d2744bb349800CVE reference, Linux
- https://git.kernel.org/stable/c/154467f4ad033473e5c903a03e7b9bca7df9a0faCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.