CVE-2025-38415Squashfs: check return result of sb_min_blocksize
- 7.8HighCVSS base score
- 0.23%Exploitation in 30 daysEPSS · top 86% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails. ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0. As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64. This subsequently causes the UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') This commit adds a check for a 0 return by sb_min_blocksize().
Timeline
ID reserved
By Linux
- 3 months later
· 3 months later
Published
- 11 months later
· 11 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.23% · top 86% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 0aa666190509ffab81c202c5095a166be23961ac – < db7096ea160e40d78c67fce52e7cc51bde049497
- affected 0aa666190509ffab81c202c5095a166be23961ac – < 549f9e3d7b60d53808c98b9fde49b4f46d0524a5
- affected 0aa666190509ffab81c202c5095a166be23961ac – < 5c51aa862cbeed2f3887f0382a2708956710bd68
- affected 0aa666190509ffab81c202c5095a166be23961ac – < 6abf6b78c6fb112eee495f5636ffcc350dd2ce25
- affected 0aa666190509ffab81c202c5095a166be23961ac – < 4f99357dadbf9c979ad737156ad4c37fadf7c56b
- affected 0aa666190509ffab81c202c5095a166be23961ac – < 0aff95d9bc7fb5400ca8af507429c4b067bdb425
- affected 0aa666190509ffab81c202c5095a166be23961ac – < 295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282
- affected 0aa666190509ffab81c202c5095a166be23961ac – < 734aa85390ea693bb7eaf2240623d41b03705c84
- affected 2.6.29
- unaffected < 2.6.29
- unaffected 5.4.295 – ≤ 5.4.*
- unaffected 5.10.239 – ≤ 5.10.*
- unaffected 5.15.186 – ≤ 5.15.*
- unaffected 6.1.142 – ≤ 6.1.*
- unaffected 6.6.94 – ≤ 6.6.*
- unaffected 6.12.34 – ≤ 6.12.*
- unaffected 6.15.3 – ≤ 6.15.*
- unaffected 6.16 – ≤ *
References
References10
- https://git.kernel.org/stable/c/db7096ea160e40d78c67fce52e7cc51bde049497 (opens in a new tab)
- https://git.kernel.org/stable/c/549f9e3d7b60d53808c98b9fde49b4f46d0524a5 (opens in a new tab)
- https://git.kernel.org/stable/c/5c51aa862cbeed2f3887f0382a2708956710bd68 (opens in a new tab)
- https://git.kernel.org/stable/c/6abf6b78c6fb112eee495f5636ffcc350dd2ce25 (opens in a new tab)
- https://git.kernel.org/stable/c/4f99357dadbf9c979ad737156ad4c37fadf7c56b (opens in a new tab)
- https://git.kernel.org/stable/c/0aff95d9bc7fb5400ca8af507429c4b067bdb425 (opens in a new tab)
- https://git.kernel.org/stable/c/295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282 (opens in a new tab)
- https://git.kernel.org/stable/c/734aa85390ea693bb7eaf2240623d41b03705c84 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-22672 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-38415)Record last updated .