01 Record

CVE-2025-38652

f2fs: fix to avoid out-of-boundary access in devs.path

HighPUBLISHEDCNA: Linux

CNA base score7.3 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

View raw JSON

02 Description

f2fs: fix to avoid out-of-boundary access in devs.path

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.18% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 7.5% of scored records. A rank, not a probability.
NVD base score: 7.1 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-07-30.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-08-22 16:00Z1 YR AGO

Last updated

2026-08-05 12:03Z2 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.3)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Weaknesses

CWE-125Out-of-bounds ReadBase

Data version

5.2

Document digest

cf05214607194fc2f9d8b753f25dc54d46f2af30d2334984f2c1aef0aee2a260

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux3c62be17d4f562f43fe1d03b48194399caa35aa5 to < dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80, 3c62be17d4f562f43fe1d03b48194399caa35aa5 to < 1cf1ff15f262e8baf12201b270b6a79f9d119b2d, 3c62be17d4f562f43fe1d03b48194399caa35aa5 to < 666b7cf6ac9aa074b8319a2b68cba7f2c30023f0, 3c62be17d4f562f43fe1d03b48194399caa35aa5 to < 3466721f06edff834f99d9f49f23eabc6b2cb78e, 3c62be17d4f562f43fe1d03b48194399caa35aa5 to < 345fc8d1838f3f8be7c8ed08d86a13dedef67136, 3c62be17d4f562f43fe1d03b48194399caa35aa5 to < 70849d33130a2cf1d6010069ed200669c8651fbd, 3c62be17d4f562f43fe1d03b48194399caa35aa5 to < 755427093e4294ac111c3f9e40d53f681a0fbdaa, 3c62be17d4f562f43fe1d03b48194399caa35aa5 to < 1b1efa5f0e878745e94a98022e8edc675a87d78e, 3c62be17d4f562f43fe1d03b48194399caa35aa5 to < 5661998536af52848cc4d52a377e90368196edea, 4.10—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80
git.kernel.orghttps://git.kernel.org/stable/c/1cf1ff15f262e8baf12201b270b6a79f9d119b2d
git.kernel.orghttps://git.kernel.org/stable/c/666b7cf6ac9aa074b8319a2b68cba7f2c30023f0
git.kernel.orghttps://git.kernel.org/stable/c/3466721f06edff834f99d9f49f23eabc6b2cb78e
git.kernel.orghttps://git.kernel.org/stable/c/345fc8d1838f3f8be7c8ed08d86a13dedef67136
git.kernel.orghttps://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd
git.kernel.orghttps://git.kernel.org/stable/c/755427093e4294ac111c3f9e40d53f681a0fbdaa
git.kernel.orghttps://git.kernel.org/stable/c/1b1efa5f0e878745e94a98022e8edc675a87d78e
git.kernel.orghttps://git.kernel.org/stable/c/5661998536af52848cc4d52a377e90368196edea
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/10/msg00007.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.148-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.43-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.16.3-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.