CVE-2025-38415

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38415
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38415.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-38415
Downstream
Related
Published
2025-07-25T13:32:09.711Z
Modified
2026-05-13T03:52:44.752230294Z
Summary
Squashfs: check return result of sb_min_blocksize
Details

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: check return result of sbminblocksize

Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfsbioread" bug.

Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOPSETBLOCKSIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfsfill_super() fails.

msblk->devblksize = sbminblocksize(sb, SQUASHFSDEVBLKSIZE);

msblk->devblksize_log2 = ffz(~msblk->devblksize);

sbminblocksize() returns 0, which means msblk->devblksize is set to 0.

As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64.

This subsequently causes the

UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long')

This commit adds a check for a 0 return by sbminblocksize().

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38415.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0aa666190509ffab81c202c5095a166be23961ac
Fixed
db7096ea160e40d78c67fce52e7cc51bde049497
Fixed
549f9e3d7b60d53808c98b9fde49b4f46d0524a5
Fixed
5c51aa862cbeed2f3887f0382a2708956710bd68
Fixed
6abf6b78c6fb112eee495f5636ffcc350dd2ce25
Fixed
4f99357dadbf9c979ad737156ad4c37fadf7c56b
Fixed
0aff95d9bc7fb5400ca8af507429c4b067bdb425
Fixed
295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282
Fixed
734aa85390ea693bb7eaf2240623d41b03705c84

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38415.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.29
Fixed
5.4.295
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.239
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.186
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.142
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.94
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.34
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.15.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38415.json"