CVE-2025-38382: btrfs: fix iteration of extrefs during log replay
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix iteration of extrefs during log replay
At inodeaddref() when processing extrefs, if we jump into the next label we have an undefined value of victimname.len, since we haven't initialized it before we did the goto. This results in an invalid memory access in the next iteration of the loop since victimname.len was not initialized to the length of the name of the current extref.
Fix this by initializing victimname.len with the current extref's name length.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38382?
CVE-2025-38382 has been classified as a medium severity vulnerability.
How do I fix CVE-2025-38382?
To resolve CVE-2025-38382, update the Linux kernel to the latest available version that includes the fix.
What are the potential impacts of CVE-2025-38382?
CVE-2025-38382 could potentially lead to system instability or a denial of service during log replay operations in btrfs.
Which versions of the Linux kernel are affected by CVE-2025-38382?
CVE-2025-38382 affects certain versions of the Linux kernel prior to the application of the relevant patches.
Is there a workaround for CVE-2025-38382?
There are no known effective workarounds for CVE-2025-38382; applying the patch is recommended.