GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38415 (GCVE-0-2025-38415)

Vulnerability from cvelistv5 – Published: 2025-07-25 13:32 – Updated: 2026-06-18 20:55
VLAI
Title
Squashfs: check return result of sb_min_blocksize
Summary
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails. ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0. As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64. This subsequently causes the UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') This commit adds a check for a 0 return by sb_min_blocksize().
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-18 20:55 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0aa666190509ffab81c202c5095a166be23961ac , < db7096ea160e40d78c67fce52e7cc51bde049497 (git)
Affected: 0aa666190509ffab81c202c5095a166be23961ac , < 549f9e3d7b60d53808c98b9fde49b4f46d0524a5 (git)
Affected: 0aa666190509ffab81c202c5095a166be23961ac , < 5c51aa862cbeed2f3887f0382a2708956710bd68 (git)
Affected: 0aa666190509ffab81c202c5095a166be23961ac , < 6abf6b78c6fb112eee495f5636ffcc350dd2ce25 (git)
Affected: 0aa666190509ffab81c202c5095a166be23961ac , < 4f99357dadbf9c979ad737156ad4c37fadf7c56b (git)
Affected: 0aa666190509ffab81c202c5095a166be23961ac , < 0aff95d9bc7fb5400ca8af507429c4b067bdb425 (git)
Affected: 0aa666190509ffab81c202c5095a166be23961ac , < 295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282 (git)
Affected: 0aa666190509ffab81c202c5095a166be23961ac , < 734aa85390ea693bb7eaf2240623d41b03705c84 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 5.4.295 , ≤ 5.4.* (semver)
Unaffected: 5.10.239 , ≤ 5.10.* (semver)
Unaffected: 5.15.186 , ≤ 5.15.* (semver)
Unaffected: 6.1.142 , ≤ 6.1.* (semver)
Unaffected: 6.6.94 , ≤ 6.6.* (semver)
Unaffected: 6.12.34 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:45.927Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38415",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-18T20:55:21.631432Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T20:55:27.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/squashfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "db7096ea160e40d78c67fce52e7cc51bde049497",
              "status": "affected",
              "version": "0aa666190509ffab81c202c5095a166be23961ac",
              "versionType": "git"
            },
            {
              "lessThan": "549f9e3d7b60d53808c98b9fde49b4f46d0524a5",
              "status": "affected",
              "version": "0aa666190509ffab81c202c5095a166be23961ac",
              "versionType": "git"
            },
            {
              "lessThan": "5c51aa862cbeed2f3887f0382a2708956710bd68",
              "status": "affected",
              "version": "0aa666190509ffab81c202c5095a166be23961ac",
              "versionType": "git"
            },
            {
              "lessThan": "6abf6b78c6fb112eee495f5636ffcc350dd2ce25",
              "status": "affected",
              "version": "0aa666190509ffab81c202c5095a166be23961ac",
              "versionType": "git"
            },
            {
              "lessThan": "4f99357dadbf9c979ad737156ad4c37fadf7c56b",
              "status": "affected",
              "version": "0aa666190509ffab81c202c5095a166be23961ac",
              "versionType": "git"
            },
            {
              "lessThan": "0aff95d9bc7fb5400ca8af507429c4b067bdb425",
              "status": "affected",
              "version": "0aa666190509ffab81c202c5095a166be23961ac",
              "versionType": "git"
            },
            {
              "lessThan": "295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282",
              "status": "affected",
              "version": "0aa666190509ffab81c202c5095a166be23961ac",
              "versionType": "git"
            },
            {
              "lessThan": "734aa85390ea693bb7eaf2240623d41b03705c84",
              "status": "affected",
              "version": "0aa666190509ffab81c202c5095a166be23961ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/squashfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check return result of sb_min_blocksize\n\nSyzkaller reports an \"UBSAN: shift-out-of-bounds in squashfs_bio_read\" bug.\n\nSyzkaller forks multiple processes which after mounting the Squashfs\nfilesystem, issues an ioctl(\"/dev/loop0\", LOOP_SET_BLOCK_SIZE, 0x8000). \nNow if this ioctl occurs at the same time another process is in the\nprocess of mounting a Squashfs filesystem on /dev/loop0, the failure\noccurs.  When this happens the following code in squashfs_fill_super()\nfails.\n\n----\nmsblk-\u003edevblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);\nmsblk-\u003edevblksize_log2 = ffz(~msblk-\u003edevblksize);\n----\n\nsb_min_blocksize() returns 0, which means msblk-\u003edevblksize is set to 0.\n\nAs a result, ffz(~msblk-\u003edevblksize) returns 64, and msblk-\u003edevblksize_log2\nis set to 64.\n\nThis subsequently causes the\n\nUBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36\nshift exponent 64 is too large for 64-bit type \u0027u64\u0027 (aka\n\u0027unsigned long long\u0027)\n\nThis commit adds a check for a 0 return by sb_min_blocksize()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:27:32.721Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/db7096ea160e40d78c67fce52e7cc51bde049497"
        },
        {
          "url": "https://git.kernel.org/stable/c/549f9e3d7b60d53808c98b9fde49b4f46d0524a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c51aa862cbeed2f3887f0382a2708956710bd68"
        },
        {
          "url": "https://git.kernel.org/stable/c/6abf6b78c6fb112eee495f5636ffcc350dd2ce25"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f99357dadbf9c979ad737156ad4c37fadf7c56b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aff95d9bc7fb5400ca8af507429c4b067bdb425"
        },
        {
          "url": "https://git.kernel.org/stable/c/295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282"
        },
        {
          "url": "https://git.kernel.org/stable/c/734aa85390ea693bb7eaf2240623d41b03705c84"
        }
      ],
      "title": "Squashfs: check return result of sb_min_blocksize",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38415",
    "datePublished": "2025-07-25T13:32:09.711Z",
    "dateReserved": "2025-04-16T04:51:24.013Z",
    "dateUpdated": "2026-06-18T20:55:27.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38415",
      "date": "2026-09-15",
      "epss": "0.00185",
      "percentile": "0.08295"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38415\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T14:15:33.250\",\"lastModified\":\"2026-06-18T21:16:28.157\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSquashfs: check return result of sb_min_blocksize\\n\\nSyzkaller reports an \\\"UBSAN: shift-out-of-bounds in squashfs_bio_read\\\" bug.\\n\\nSyzkaller forks multiple processes which after mounting the Squashfs\\nfilesystem, issues an ioctl(\\\"/dev/loop0\\\", LOOP_SET_BLOCK_SIZE, 0x8000). \\nNow if this ioctl occurs at the same time another process is in the\\nprocess of mounting a Squashfs filesystem on /dev/loop0, the failure\\noccurs.  When this happens the following code in squashfs_fill_super()\\nfails.\\n\\n----\\nmsblk-\u003edevblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);\\nmsblk-\u003edevblksize_log2 = ffz(~msblk-\u003edevblksize);\\n----\\n\\nsb_min_blocksize() returns 0, which means msblk-\u003edevblksize is set to 0.\\n\\nAs a result, ffz(~msblk-\u003edevblksize) returns 64, and msblk-\u003edevblksize_log2\\nis set to 64.\\n\\nThis subsequently causes the\\n\\nUBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36\\nshift exponent 64 is too large for 64-bit type \u0027u64\u0027 (aka\\n\u0027unsigned long long\u0027)\\n\\nThis commit adds a check for a 0 return by sb_min_blocksize().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Squashfs: comprobar el resultado devuelto de sb_min_blocksize. Syzkaller informa del error \\\"UBSAN: desplazamiento fuera de los l\u00edmites en squashfs_bio_read\\\". Syzkaller bifurca varios procesos que, tras montar el sistema de archivos Squashfs, emiten una instrucci\u00f3n ioctl(\\\"/dev/loop0\\\", LOOP_SET_BLOCK_SIZE, 0x8000). Si esta instrucci\u00f3n ioctl se produce al mismo tiempo que otro proceso est\u00e1 montando un sistema de archivos Squashfs en /dev/loop0, se produce el fallo. En este caso, el siguiente c\u00f3digo en squashfs_fill_super() falla: ---- msblk-\u0026gt;devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk-\u0026gt;devblksize_log2 = ffz(~msblk-\u0026gt;devblksize); ---- sb_min_blocksize() devuelve 0, lo que significa que msblk-\u0026gt;devblksize est\u00e1 establecido en 0. Como resultado, ffz(~msblk-\u0026gt;devblksize) devuelve 64 y msblk-\u0026gt;devblksize_log2 est\u00e1 establecido en 64. Esto posteriormente provoca el UBSAN: shift-out-of-bounds en fs/squashfs/block.c:195:36 el exponente de desplazamiento 64 es demasiado grande para el tipo de 64 bits \u0027u64\u0027 (tambi\u00e9n conocido como \u0027unsigned long long\u0027) Esta confirmaci\u00f3n agrega una comprobaci\u00f3n para un retorno de 0 por sb_min_blocksize().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/squashfs/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0aa666190509ffab81c202c5095a166be23961ac\",\"lessThan\":\"db7096ea160e40d78c67fce52e7cc51bde049497\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0aa666190509ffab81c202c5095a166be23961ac\",\"lessThan\":\"549f9e3d7b60d53808c98b9fde49b4f46d0524a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0aa666190509ffab81c202c5095a166be23961ac\",\"lessThan\":\"5c51aa862cbeed2f3887f0382a2708956710bd68\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0aa666190509ffab81c202c5095a166be23961ac\",\"lessThan\":\"6abf6b78c6fb112eee495f5636ffcc350dd2ce25\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0aa666190509ffab81c202c5095a166be23961ac\",\"lessThan\":\"4f99357dadbf9c979ad737156ad4c37fadf7c56b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0aa666190509ffab81c202c5095a166be23961ac\",\"lessThan\":\"0aff95d9bc7fb5400ca8af507429c4b067bdb425\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0aa666190509ffab81c202c5095a166be23961ac\",\"lessThan\":\"295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0aa666190509ffab81c202c5095a166be23961ac\",\"lessThan\":\"734aa85390ea693bb7eaf2240623d41b03705c84\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/squashfs/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.29\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.29\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.295\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.239\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.186\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.142\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.94\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.34\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-18T20:55:21.631432Z\",\"id\":\"CVE-2025-38415\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.29\",\"versionEndExcluding\":\"5.4.295\",\"matchCriteriaId\":\"D5BDC9F5-7B03-44B2-BD32-CD273F349554\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.239\",\"matchCriteriaId\":\"C3D14F4C-A21E-465D-A928-5CCE684E2B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.186\",\"matchCriteriaId\":\"D96F2C0D-0D4A-4658-AD34-D8A626EA422D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.142\",\"matchCriteriaId\":\"459B4E94-FE0E-434D-B782-95E3A5FFC6B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.94\",\"matchCriteriaId\":\"304E3F01-7D7A-4908-994E-7F95C5C00B06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.34\",\"matchCriteriaId\":\"4FFA54AA-CDFE-4591-BD07-72813D0948F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0aff95d9bc7fb5400ca8af507429c4b067bdb425\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4f99357dadbf9c979ad737156ad4c37fadf7c56b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/549f9e3d7b60d53808c98b9fde49b4f46d0524a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5c51aa862cbeed2f3887f0382a2708956710bd68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6abf6b78c6fb112eee495f5636ffcc350dd2ce25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/734aa85390ea693bb7eaf2240623d41b03705c84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/db7096ea160e40d78c67fce52e7cc51bde049497\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:07:55+00:00",
      "cve": "CVE-2025-38415",
      "id": "CVE-2025-38415",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:fixed": "2416",
      "product_status:known_affected": "36",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38415.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T17:01:13Z",
      "cve": "CVE-2025-38415",
      "id": "CVE-2025-38415",
      "initial_release_date": "2025-07-29T23:23:54Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "737",
      "product_status:known_not_affected": "43",
      "product_status:recommended": "625",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38415",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38415.json",
      "version": "47"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T17:37:45.927Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38415\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-18T20:55:21.631432Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:39:14.218Z\"}}], \"cna\": {\"title\": \"Squashfs: check return result of sb_min_blocksize\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0aa666190509ffab81c202c5095a166be23961ac\", \"lessThan\": \"db7096ea160e40d78c67fce52e7cc51bde049497\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0aa666190509ffab81c202c5095a166be23961ac\", \"lessThan\": \"549f9e3d7b60d53808c98b9fde49b4f46d0524a5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0aa666190509ffab81c202c5095a166be23961ac\", \"lessThan\": \"5c51aa862cbeed2f3887f0382a2708956710bd68\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0aa666190509ffab81c202c5095a166be23961ac\", \"lessThan\": \"6abf6b78c6fb112eee495f5636ffcc350dd2ce25\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0aa666190509ffab81c202c5095a166be23961ac\", \"lessThan\": \"4f99357dadbf9c979ad737156ad4c37fadf7c56b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0aa666190509ffab81c202c5095a166be23961ac\", \"lessThan\": \"0aff95d9bc7fb5400ca8af507429c4b067bdb425\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0aa666190509ffab81c202c5095a166be23961ac\", \"lessThan\": \"295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0aa666190509ffab81c202c5095a166be23961ac\", \"lessThan\": \"734aa85390ea693bb7eaf2240623d41b03705c84\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/squashfs/super.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.29\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.29\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.295\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.239\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.186\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.142\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.94\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.34\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/squashfs/super.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/db7096ea160e40d78c67fce52e7cc51bde049497\"}, {\"url\": \"https://git.kernel.org/stable/c/549f9e3d7b60d53808c98b9fde49b4f46d0524a5\"}, {\"url\": \"https://git.kernel.org/stable/c/5c51aa862cbeed2f3887f0382a2708956710bd68\"}, {\"url\": \"https://git.kernel.org/stable/c/6abf6b78c6fb112eee495f5636ffcc350dd2ce25\"}, {\"url\": \"https://git.kernel.org/stable/c/4f99357dadbf9c979ad737156ad4c37fadf7c56b\"}, {\"url\": \"https://git.kernel.org/stable/c/0aff95d9bc7fb5400ca8af507429c4b067bdb425\"}, {\"url\": \"https://git.kernel.org/stable/c/295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282\"}, {\"url\": \"https://git.kernel.org/stable/c/734aa85390ea693bb7eaf2240623d41b03705c84\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSquashfs: check return result of sb_min_blocksize\\n\\nSyzkaller reports an \\\"UBSAN: shift-out-of-bounds in squashfs_bio_read\\\" bug.\\n\\nSyzkaller forks multiple processes which after mounting the Squashfs\\nfilesystem, issues an ioctl(\\\"/dev/loop0\\\", LOOP_SET_BLOCK_SIZE, 0x8000). \\nNow if this ioctl occurs at the same time another process is in the\\nprocess of mounting a Squashfs filesystem on /dev/loop0, the failure\\noccurs.  When this happens the following code in squashfs_fill_super()\\nfails.\\n\\n----\\nmsblk-\u003edevblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);\\nmsblk-\u003edevblksize_log2 = ffz(~msblk-\u003edevblksize);\\n----\\n\\nsb_min_blocksize() returns 0, which means msblk-\u003edevblksize is set to 0.\\n\\nAs a result, ffz(~msblk-\u003edevblksize) returns 64, and msblk-\u003edevblksize_log2\\nis set to 64.\\n\\nThis subsequently causes the\\n\\nUBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36\\nshift exponent 64 is too large for 64-bit type \u0027u64\u0027 (aka\\n\u0027unsigned long long\u0027)\\n\\nThis commit adds a check for a 0 return by sb_min_blocksize().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.295\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.239\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.186\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.142\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.94\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.34\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15.3\", \"versionStartIncluding\": \"2.6.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16\", \"versionStartIncluding\": \"2.6.29\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:27:32.721Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-38415\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-18T20:55:27.614Z\", \"dateReserved\": \"2025-04-16T04:51:24.013Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-07-25T13:32:09.711Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.