CVE-2025-38652

What it actually does

Out-of-bounds memory access in f2fs when a device path exactly fills MAX_PATH_LEN without a trailing null byte, causing adjacent struct fields to be interpreted as path data and leading to incorrect device path parsing during mount.

Why it matters to the business

Filesystem mount failures or incorrect device handling on Linux systems using f2fs can interrupt storage operations and require manual intervention or reboots until systems are updated.

How an attack unfolds

An attacker supplies a device path argument of exactly MAX_PATH_LEN bytes (for example via mkfs.f2fs -c or mount) so that sbi->devs.path[] lacks a null terminator; subsequent fields are then treated as part of the path string, resulting in failed device discovery or malformed mount behavior.

How to fix it

Apply the upstream fix that reserves one additional byte for the path null terminator (commit dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80) and update affected Linux kernel packages or rebuild from the patched source; Chainguard openjdk-17-openj9 variants should be upgraded to 0.53.0-r0 or later.

How to confirm the fix worked

Verify the running kernel contains commit dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80, confirm MAX_PATH_LEN-sized paths now receive a terminating null byte, and test mount operations with boundary-length device paths.

Typical attack path

1. Identify a target system using the f2fs filesystem
2. Create a device path string whose length equals MAX_PATH_LEN
3. Invoke mkfs.f2fs or mount with the crafted path via the -c option or equivalent
4. Observe kernel log messages showing truncated or corrupted device path and mount failure

How to detect it

Search kernel logs (dmesg, journalctl) for F2FS mount messages that show truncated device paths ending in non-printable bytes or that report "Failed to find devices" immediately after a long path is supplied; correlate with process execution of mkfs.f2fs or mount containing unusually long path arguments.

What your security team should do

• Prioritize kernel updates on all systems using f2fs
• Add the fixed commit hash to patch-management and SBOM tracking
• Monitor kernel logs for F2FS mount failures referencing device paths
• Review any custom f2fs mount scripts that construct long device paths