LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38710: gfs2: Validate i_depth for exhash directories

In the Linux kernel, the following vulnerability has been resolved: gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at: index = hash >> (32 - dip->i_depth); As calculated in an open-coded way in dir_make_exhash(), the minimum depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time. So we can avoid the undefined behaviour by checking for depth values lower than the minimum in gfs2_dinode_in(). Values greater than the maximum are already being checked for there. Also switch the calculation in dir_make_exhash() to use ilog2() to clarify how the depth is calculated. Tested with the syzkaller repro.c and xfstests '-g quick'.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-38710 is a Linux kernel GFS2 filesystem flaw. Corrupted directory metadata can leave an exhash directory with an invalid depth of 0, triggering undefined kernel behavior. The public record shows a kernel fix and syzkaller testing, but no CVSS score or confirmed exploitation.

Executive priority

Treat as a targeted kernel maintenance issue for GFS2 environments, not a broad emergency from current evidence. Patch affected Linux clusters through normal urgent maintenance, escalating only where GFS2 is actively used on critical systems.

Technical view

In GFS2, dir_e_read() shifts by 32 when dip->i_depth is 0. The fix validates exhash directory i_depth in gfs2_dinode_in(), rejecting values below the calculated minimum; excessive values were already checked. The patch also clarifies depth calculation in dir_make_exhash() using ilog2().

Likely exposure

Exposure appears limited to Linux systems using or able to mount GFS2 filesystems, especially shared-storage clusters. Systems without GFS2 mounted or enabled are less likely to be exposed. Distribution-specific fixed package versions are not provided in the source bundle.

Exploitation context

The source describes discovery through fuzzing with a syzkaller reproducer and validation with xfstests. CISA KEV status is false in the bundle, and no cited source states active exploitation or public weaponization.

Researcher notes

Key uncertainty is impact severity: the source only states undefined behavior from an invalid shift caused by corrupted metadata. It does not establish privilege boundaries, remote reachability, crash reliability, or data compromise. Avoid assuming exploitability beyond malformed or corrupted GFS2 metadata handling.

Mitigation direction

  • Apply Linux kernel updates containing the referenced GFS2 validation fix.
  • Prioritize hosts that mount GFS2, including cluster and shared-storage nodes.
  • Check distribution vendor advisories for exact fixed kernel package versions.
  • If patching is delayed, reduce unnecessary GFS2 mounting where operationally possible.

Validation and detection

  • Inventory Linux hosts for mounted or configured GFS2 filesystems.
  • Map running kernel versions to vendor advisories or referenced stable commits.
  • Confirm patched kernels include validation for exhash directory i_depth.
  • Review kernel logs for GFS2 filesystem corruption or mount errors.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38710 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9a0045088d888c9c539c8c626a366cb52c0fbdab, 9a0045088d888c9c539c8c626a366cb52c0fbdab, 9a0045088d888c9c539c8c626a366cb52c0fbdab, 9a0045088d888c9c539c8c626a366cb52c0fbdab, 9a0045088d888c9c539c8c626a366cb52c0fbdab, 9a0045088d888c9c539c8c626a366cb52c0fbdab, 9a0045088d888c9c539c8c626a366cb52c0fbdab, 9a0045088d888c9c539c8c626a366cb52c0fbdabunaffected
LinuxLinux2.6.26, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.134, 6.12.43, 6.15.11, 6.16.2, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.