{
  "cveId": "CVE-2025-38677",
  "url": "https://patchblox.com/security/cve/CVE-2025-38677",
  "summary": "CVE-2025-38677 is fixed in 9 products on 1 platform, first by DEBIAN-CVE-2025-38677, released August 30, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "f2fs: fix to avoid out-of-boundary access in dnode page",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to avoid out-of-boundary access in dnode page  As Jiaming Zhang reported:   \u003CTASK\u003E  __dump_stack lib/dump_stack.c:94 [inline]  dump_stack_lvl\u002B0x1c1/0x2a0 lib/dump_stack.c:120  print_address_description mm/kasan/report.c:378 [inline]  print_report\u002B0x17e/0x800 mm/kasan/report.c:480  kasan_report\u002B0x147/0x180 mm/kasan/report.c:593  data_blkaddr fs/f2fs/f2fs.h:3053 [inline]  f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline]  f2fs_get_dnode_of_data\u002B0x1a09/0x1c40 fs/f2fs/node.c:855  f2fs_reserve_block\u002B0x53/0x310 fs/f2fs/data.c:1195  prepare_write_begin fs/f2fs/data.c:3395 [inline]  f2fs_write_begin\u002B0xf39/0x2190 fs/f2fs/data.c:3594  generic_perform_write\u002B0x2c7/0x910 mm/filemap.c:4112  f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline]  f2fs_file_write_iter\u002B0x1ec8/0x2410 fs/f2fs/file.c:5216  new_sync_write fs/read_write.c:593 [inline]  vfs_write\u002B0x546/0xa90 fs/read_write.c:686  ksys_write\u002B0x149/0x250 fs/read_write.c:738  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]  do_syscall_64\u002B0xf3/0x3d0 arch/x86/entry/syscall_64.c:94  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f  The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 \u002B 934 * 4 = 4096 w/ 4 bytes.  To fix this issue, let\u0027s add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data().",
  "published": "2025-08-30T10:15:36Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00179,
  "epssPercentile": 0.07497,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-38677",
  "fixes": [
    {
      "platform": "linux",
      "product": "kernel-uek",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-container-debug",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-debug-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-devel",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-doc",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-uek-tools",
      "release": "ol 8",
      "fixedVersion": "0:5.4.17-2136.348.3.el7uek",
      "fix": "ELSA-2025-20663",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-20663",
      "released": "2025-10-11T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.153-1",
      "fix": "DEBIAN-CVE-2025-38677",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-38677",
      "released": "2025-08-30T10:15:36Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.48-1",
      "fix": "DEBIAN-CVE-2025-38677",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-38677",
      "released": "2025-08-30T10:15:36Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.16.5-1",
      "fix": "DEBIAN-CVE-2025-38677",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-38677",
      "released": "2025-08-30T10:15:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}