{
  "cveId": "CVE-2025-38347",
  "url": "https://patchblox.com/security/cve/CVE-2025-38347",
  "summary": "CVE-2025-38347 is fixed in 9 products on 1 platform, first by DEBIAN-CVE-2025-38347, released July 10, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "f2fs: fix to do sanity check on ino and xnid",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to do sanity check on ino and xnid  syzbot reported a f2fs bug as below:  INFO: task syz-executor140:5308 blocked for more than 143 seconds.       Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 \u0022echo 0 \u003E /proc/sys/kernel/hung_task_timeout_secs\u0022 disables this message. task:syz-executor140 state:D stack:24016 pid:5308  tgid:5308  ppid:5306   task_flags:0x400140 flags:0x00000006 Call Trace:  \u003CTASK\u003E  context_switch kernel/sched/core.c:5378 [inline]  __schedule\u002B0x190e/0x4c90 kernel/sched/core.c:6765  __schedule_loop kernel/sched/core.c:6842 [inline]  schedule\u002B0x14b/0x320 kernel/sched/core.c:6857  io_schedule\u002B0x8d/0x110 kernel/sched/core.c:7690  folio_wait_bit_common\u002B0x839/0xee0 mm/filemap.c:1317  __folio_lock mm/filemap.c:1664 [inline]  folio_lock include/linux/pagemap.h:1163 [inline]  __filemap_get_folio\u002B0x147/0xb40 mm/filemap.c:1917  pagecache_get_page\u002B0x2c/0x130 mm/folio-compat.c:87  find_get_page_flags include/linux/pagemap.h:842 [inline]  f2fs_grab_cache_page\u002B0x2b/0x320 fs/f2fs/f2fs.h:2776  __get_node_page\u002B0x131/0x11b0 fs/f2fs/node.c:1463  read_xattr_block\u002B0xfb/0x190 fs/f2fs/xattr.c:306  lookup_all_xattrs fs/f2fs/xattr.c:355 [inline]  f2fs_getxattr\u002B0x676/0xf70 fs/f2fs/xattr.c:533  __f2fs_get_acl\u002B0x52/0x870 fs/f2fs/acl.c:179  f2fs_acl_create fs/f2fs/acl.c:375 [inline]  f2fs_init_acl\u002B0xd7/0x9b0 fs/f2fs/acl.c:418  f2fs_init_inode_metadata\u002B0xa0f/0x1050 fs/f2fs/dir.c:539  f2fs_add_inline_entry\u002B0x448/0x860 fs/f2fs/inline.c:666  f2fs_add_dentry\u002B0xba/0x1e0 fs/f2fs/dir.c:765  f2fs_do_add_link\u002B0x28c/0x3a0 fs/f2fs/dir.c:808  f2fs_add_link fs/f2fs/f2fs.h:3616 [inline]  f2fs_mknod\u002B0x2e8/0x5b0 fs/f2fs/namei.c:766  vfs_mknod\u002B0x36d/0x3b0 fs/namei.c:4191  unix_bind_bsd net/unix/af_unix.c:1286 [inline]  unix_bind\u002B0x563/0xe30 net/unix/af_unix.c:1379  __sys_bind_socket net/socket.c:1817 [inline]  __sys_bind\u002B0x1e4/0x290 net/socket.c:1848  __do_sys_bind net/socket.c:1853 [inline]  __se_sys_bind net/socket.c:1851 [inline]  __x64_sys_bind\u002B0x7a/0x90 net/socket.c:1851  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64\u002B0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f  Let\u0027s dump and check metadata of corrupted inode, it shows its xattr_nid is the same to its i_ino.  dump.f2fs -i 3 chaseyu.img.raw i_xattr_nid                             [0x       3 : 3]  So that, during mknod in the corrupted directory, it tries to get and lock inode page twice, result in deadlock.  - f2fs_mknod  - f2fs_add_inline_entry   - f2fs_get_inode_page --- lock dir\u0027s inode page    - f2fs_init_acl     - f2fs_acl_create(dir,..)      - __f2fs_get_acl       - f2fs_getxattr        - lookup_all_xattrs         - __get_node_page --- try to lock dir\u0027s inode page  In order to fix this, let\u0027s add sanity check on ino and xnid.",
  "published": "2025-07-10T09:15:29Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00194,
  "epssPercentile": 0.09175,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-38347",
  "fixes": [
    {
      "platform": "linux",
      "product": "kernel-uek",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container-debug",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-doc",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-tools",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.153-1",
      "fix": "DEBIAN-CVE-2025-38347",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-38347",
      "released": "2025-07-10T09:15:29Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.35-1",
      "fix": "DEBIAN-CVE-2025-38347",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-38347",
      "released": "2025-07-10T09:15:29Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.12.35-1",
      "fix": "DEBIAN-CVE-2025-38347",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-38347",
      "released": "2025-07-10T09:15:29Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}