CVE-2025-38579

What it actually does

Use of uninitialized fields in struct extent_info within f2fs read extent tree path, specifically in __is_extent_mergeable and __is_back_mergeable after partial initialization by get_read_extent_info, resulting in undefined behavior on access during extent merging.

Why it matters to the business

Risk of kernel instability, crashes, or unpredictable behavior on Linux systems using f2fs, potentially disrupting storage operations and requiring restarts; widespread impact due to kernel prevalence with low but present exploitation probability.

How an attack unfolds

An attacker with local access crafts file system operations that traverse the read extent tree, triggering access to uninitialized fields during merge checks; listed threat actors focus on related kernel privilege escalations on container-optimized OS but no direct public exploit for this issue exists.

How to fix it

Update to fixed kernel commit 08e8ab00a6d20d5544c932ee85a297d833895141 or Chainguard package versions 0.53.0-r0 for affected OpenJDK-11-openj9 variants; rebuild and reboot systems after applying the zero-initialization patch.

How to confirm the fix worked

Verify kernel source contains the zero-initialization of extent_info struct before population in get_read_extent_info; re-run KMSAN on f2fs extent paths or confirm absence of uninit-value reports in affected merge functions.

Typical attack path

1. Obtain local code execution or user access on target Linux system
2. Perform file I/O operations that populate and merge read extents in f2fs
3. Trigger path through get_read_extent_info followed by mergeability checks
4. Cause undefined behavior from uninitialized struct fields leading to crash or corruption

How to detect it

Search kernel logs for KMSAN reports or uninitialized value warnings involving extent_info, __is_extent_mergeable, or f2fs read paths; review system crashes correlated with f2fs extent merging activity.

What your security team should do

• Prioritize patching production Linux kernels with f2fs within 30 days given publication age
• Monitor for related kernel privilege escalation activity from listed threat actors
• Test fixed versions in staging before broad deployment
• Audit f2fs usage in container and storage workloads for exposure