Linux Kernel Vulnerability in gfs2 Exhash Directory Handling

CVE-2025-38710

What is CVE-2025-38710?

A vulnerability in the gfs2 component of the Linux kernel relates to improper validation of the i_depth for exhash directories. When a fuzzing test creates a scenario resulting in a depth value of zero, it leads to an undefined shift operation. This happens during the reading process of directories, where the incorrectly calculated depth can cause instability and potentially allow for further exploitation. The issue can be mitigated by ensuring depth values do not fall below the minimum threshold, which is determined based on the configuration during the mounting of the filesystem.

References