In the Linux kernel, the following vulnerability has been resolved:
Squashfs: check return result of sbminblocksize
Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfsbioread" bug.
Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOPSETBLOCKSIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfsfill_super() fails.
msblk->devblksize = sbminblocksize(sb, SQUASHFSDEVBLKSIZE);
sbminblocksize() returns 0, which means msblk->devblksize is set to 0.
As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64.
This subsequently causes the
UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long')
This commit adds a check for a 0 return by sbminblocksize().
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169813988701208228759836507371027222273",
"158523551420020611962185964761319554748",
"333726604313851232760192842023160582536",
"325192101403060020514640098294385481952"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c51aa862cbeed2f3887f0382a2708956710bd68",
"deprecated": false,
"id": "CVE-2025-38415-1453f478",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"function_hash": "338702861329101805866819192316052765996",
"length": 6992.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abf6b78c6fb112eee495f5636ffcc350dd2ce25",
"deprecated": false,
"id": "CVE-2025-38415-3e449855",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "squashfs_fill_super",
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"function_hash": "56442780668167955426024868242219725729",
"length": 7686.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282",
"deprecated": false,
"id": "CVE-2025-38415-5667fba4",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "squashfs_fill_super",
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"146712078645354964931958175754031432053",
"159544887500319028263178603718217563785",
"116196360306266814884956464869152296979",
"325192101403060020514640098294385481952"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@549f9e3d7b60d53808c98b9fde49b4f46d0524a5",
"deprecated": false,
"id": "CVE-2025-38415-68077744",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"function_hash": "270772870623119155805727854400802331056",
"length": 7542.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0aff95d9bc7fb5400ca8af507429c4b067bdb425",
"deprecated": false,
"id": "CVE-2025-38415-ae17446b",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "squashfs_fill_super",
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"13681385609352075676659604632898420295",
"290966426458622842905636736475062317586",
"333726604313851232760192842023160582536",
"325192101403060020514640098294385481952"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@734aa85390ea693bb7eaf2240623d41b03705c84",
"deprecated": false,
"id": "CVE-2025-38415-bad65f9b",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"function_hash": "24937988161116821401307886402564383199",
"length": 6903.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@549f9e3d7b60d53808c98b9fde49b4f46d0524a5",
"deprecated": false,
"id": "CVE-2025-38415-c283f8ee",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "squashfs_fill_super",
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"169813988701208228759836507371027222273",
"158523551420020611962185964761319554748",
"333726604313851232760192842023160582536",
"325192101403060020514640098294385481952"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abf6b78c6fb112eee495f5636ffcc350dd2ce25",
"deprecated": false,
"id": "CVE-2025-38415-c9fc0eaa",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"function_hash": "333584182235848470055819168279064302400",
"length": 7004.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c51aa862cbeed2f3887f0382a2708956710bd68",
"deprecated": false,
"id": "CVE-2025-38415-d3e2f1e8",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "squashfs_fill_super",
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"13681385609352075676659604632898420295",
"290966426458622842905636736475062317586",
"333726604313851232760192842023160582536",
"325192101403060020514640098294385481952"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282",
"deprecated": false,
"id": "CVE-2025-38415-e3f9711e",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"function_hash": "56442780668167955426024868242219725729",
"length": 7686.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@734aa85390ea693bb7eaf2240623d41b03705c84",
"deprecated": false,
"id": "CVE-2025-38415-ebc6924a",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "squashfs_fill_super",
"file": "fs/squashfs/super.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"13681385609352075676659604632898420295",
"290966426458622842905636736475062317586",
"333726604313851232760192842023160582536",
"325192101403060020514640098294385481952"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0aff95d9bc7fb5400ca8af507429c4b067bdb425",
"deprecated": false,
"id": "CVE-2025-38415-f263d792",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/squashfs/super.c"
}
}
]