OESA-2025-2661

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-2661
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2025-2661.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2025-2661
Upstream
Published
2025-11-14T12:38:45Z
Modified
2025-11-17T04:49:33.149099Z
Summary
kernel security update
Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: check return result of sbminblocksize

Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfsbioread" bug.

Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOPSETBLOCKSIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfsfill_super() fails.

msblk->devblksize = sbminblocksize(sb, SQUASHFSDEVBLKSIZE);

msblk->devblksize_log2 = ffz(~msblk->devblksize);

sbminblocksize() returns 0, which means msblk->devblksize is set to 0.

As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64.

This subsequently causes the

UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long')

This commit adds a check for a 0 return by sbminblocksize().(CVE-2025-38415)

Database specific 
{
    "severity": "Low"
}
References

Affected packages

openEuler:22.03-LTS-SP4 / kernel

Package

Name
kernel
Purl
pkg:rpm/openEuler/kernel&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.0-289.0.0.192.oe2203sp4

Ecosystem specific 

{
    "aarch64": [
        "bpftool-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "bpftool-debuginfo-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "kernel-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "kernel-debuginfo-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "kernel-debugsource-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "kernel-devel-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "kernel-headers-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "kernel-source-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "kernel-tools-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "kernel-tools-debuginfo-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "kernel-tools-devel-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "perf-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "perf-debuginfo-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "python3-perf-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm",
        "python3-perf-debuginfo-5.10.0-289.0.0.192.oe2203sp4.aarch64.rpm"
    ],
    "x86_64": [
        "bpftool-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "bpftool-debuginfo-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "kernel-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "kernel-debuginfo-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "kernel-debugsource-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "kernel-devel-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "kernel-headers-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "kernel-source-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "kernel-tools-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "kernel-tools-debuginfo-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "kernel-tools-devel-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "perf-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "perf-debuginfo-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "python3-perf-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm",
        "python3-perf-debuginfo-5.10.0-289.0.0.192.oe2203sp4.x86_64.rpm"
    ],
    "src": [
        "kernel-5.10.0-289.0.0.192.oe2203sp4.src.rpm"
    ]
}