Out-of-Bound Access Vulnerability in Linux Kernel's F2FS Filesystem

CVE-2025-38677

What is CVE-2025-38677?

This vulnerability in the Linux kernel's F2FS filesystem is caused by an out-of-bounds access issue, whereby a corrupted directory node (dnode) with the same node ID as its inode can lead to improper memory access. When the function f2fs_get_dnode_of_data() tries to access the block address in the dnode, it misinterprets it as an inode. This results in an attempt to access a memory location outside allowable bounds. To mitigate this issue, a sanity check for node IDs is implemented during the execution of f2fs_get_dnode_of_data() to prevent such erroneous accesses.

References