CVE-2025-38710

What it actually does

Invalid i_depth value of 0 in exhash GFS2 directories triggers an undefined 32-bit shift in dir_e_read() during hash calculation.

Why it matters to the business

Local users on GFS2 filesystems can trigger kernel crashes leading to denial of service; high prevalence in Linux environments increases exposure risk.

How an attack unfolds

An attacker with local access supplies a corrupted GFS2 filesystem image containing an exhash directory with i_depth set to 0; when the kernel processes the directory in dir_e_read(), the invalid shift occurs and causes undefined behavior.

How to fix it

Upgrade the Linux kernel to the fixed commit 53a0249d68a210c16e961b83adfa82f94ee0a53d or later; rebuild and deploy updated kernels across all affected systems.

How to confirm the fix worked

Verify the presence of commit 53a0249d68a210c16e961b83adfa82f94ee0a53d in the kernel source tree and confirm the minimum depth check now exists in gfs2_dinode_in().

Typical attack path

1. Obtain local access to a system using GFS2
2. Mount a maliciously crafted GFS2 image or trigger directory operations on corrupted metadata
3. Invoke dir_e_read() to execute the invalid shift and crash the kernel

How to detect it

Review kernel logs for GFS2-related oops or panic messages involving dir_e_read() or undefined shifts; correlate with recent mounts of external GFS2 volumes.

What your security team should do

• Apply the referenced kernel commit immediately on all GFS2 deployments
• Prioritize patching systems with high GFS2 usage or container workloads
• Test the update with xfstests and syzkaller reproducers before broad rollout