AZL-66596
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-66596.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-66596
- Upstream
- Published
- 2025-08-22T16:15:40Z
- Modified
- 2026-04-01T05:21:00.320560Z
- Summary
- CVE-2025-38652 affecting package kernel for versions less than 6.6.104.2-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid out-of-boundary access in devs.path
- touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123
- truncate -s $((102410241024)) \ /mnt/f2fs/012345678901234567890123456789012345678901234567890123
- touch /mnt/f2fs/file
- truncate -s $((102410241024)) /mnt/f2fs/file
- mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ -c /mnt/f2fs/file
- mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ /mnt/f2fs/loop
[16937.192268] F2FS-fs (loop0): Failed to find devices
If device path length equals to MAXPATHLEN, sbi->devs.path[] may not end up w/ null character due to path array is fully filled, So accidently, fields locate after path[] may be treated as part of device path, result in parsing wrong device path.
struct f2fsdevinfo { ... char path[MAXPATHLEN]; ... };
Let's add one byte space for sbi->devs.path[] to store null character of device path string.
- References