In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid out-of-boundary access in devs.path
[16937.192268] F2FS-fs (loop0): Failed to find devices
If device path length equals to MAXPATHLEN, sbi->devs.path[] may not end up w/ null character due to path array is fully filled, So accidently, fields locate after path[] may be treated as part of device path, result in parsing wrong device path.
struct f2fsdevinfo { ... char path[MAXPATHLEN]; ... };
Let's add one byte space for sbi->devs.path[] to store null character of device path string.
[
{
"id": "CVE-2025-38652-09a2c97f",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/f2fs.h"
},
"digest": {
"line_hashes": [
"320017964641317340651967282690441121874",
"81644776258376517613716744561378431535",
"326441455551603201391041850838023154343",
"335803760321613655662100127686103288981"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@666b7cf6ac9aa074b8319a2b68cba7f2c30023f0",
"deprecated": false
},
{
"id": "CVE-2025-38652-4b70a04a",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/f2fs.h"
},
"digest": {
"line_hashes": [
"320017964641317340651967282690441121874",
"81644776258376517613716744561378431535",
"326441455551603201391041850838023154343",
"335803760321613655662100127686103288981"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80",
"deprecated": false
},
{
"id": "CVE-2025-38652-5046d74a",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/f2fs.h"
},
"digest": {
"line_hashes": [
"168390798327985228669560338565098265597",
"9507932505574746405002199272594869054",
"326441455551603201391041850838023154343",
"335803760321613655662100127686103288981"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5661998536af52848cc4d52a377e90368196edea",
"deprecated": false
},
{
"id": "CVE-2025-38652-6bd38da4",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/f2fs.h"
},
"digest": {
"line_hashes": [
"168390798327985228669560338565098265597",
"9507932505574746405002199272594869054",
"326441455551603201391041850838023154343",
"335803760321613655662100127686103288981"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b1efa5f0e878745e94a98022e8edc675a87d78e",
"deprecated": false
},
{
"id": "CVE-2025-38652-81efc49f",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/f2fs.h"
},
"digest": {
"line_hashes": [
"320017964641317340651967282690441121874",
"81644776258376517613716744561378431535",
"326441455551603201391041850838023154343",
"335803760321613655662100127686103288981"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1cf1ff15f262e8baf12201b270b6a79f9d119b2d",
"deprecated": false
},
{
"id": "CVE-2025-38652-b659c0ee",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/f2fs.h"
},
"digest": {
"line_hashes": [
"320017964641317340651967282690441121874",
"81644776258376517613716744561378431535",
"326441455551603201391041850838023154343",
"335803760321613655662100127686103288981"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3466721f06edff834f99d9f49f23eabc6b2cb78e",
"deprecated": false
},
{
"id": "CVE-2025-38652-c2cd018a",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/f2fs.h"
},
"digest": {
"line_hashes": [
"168390798327985228669560338565098265597",
"9507932505574746405002199272594869054",
"326441455551603201391041850838023154343",
"335803760321613655662100127686103288981"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70849d33130a2cf1d6010069ed200669c8651fbd",
"deprecated": false
},
{
"id": "CVE-2025-38652-dd408013",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/f2fs/f2fs.h"
},
"digest": {
"line_hashes": [
"320017964641317340651967282690441121874",
"81644776258376517613716744561378431535",
"326441455551603201391041850838023154343",
"335803760321613655662100127686103288981"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@345fc8d1838f3f8be7c8ed08d86a13dedef67136",
"deprecated": false
}
]