---
id: CVE-2025-38710
title: 'gfs2: Validate i_depth for exhash directories'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gfs2: Validate i_depth for exhash directories

  A fuzzer test introduced corruption that ends up with a depth of 0 in
  dir_e_read(), causing an undefined shift by 32 at:
  …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab <
    076e992752e4b24178918f748d75597c80a408d2
  - >-
    Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab <
    366183911b153e9b8cf758e1414e1154d7569337
  - >-
    Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab <
    112bb60cd0e254a369e95aa9941a694ffeca089f
  - >-
    Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab <
    cddea0c721106ea480371412d8de21705eb27376
  - >-
    Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab <
    53a0249d68a210c16e961b83adfa82f94ee0a53d
  - >-
    Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab <
    b5f46951e62377b6e406fadc18bc3c5bdf1632a7
  - >-
    Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab <
    9680c58675b82348ab84d387e4fa727f7587e1a0
  - >-
    Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab <
    557c024ca7250bb65ae60f16c02074106c2f197b
  - Linux 2.6.26
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:52:51.698031Z'
published: '2025-09-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:02:28.235Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38710'
references:
  - url: 'https://git.kernel.org/stable/c/076e992752e4b24178918f748d75597c80a408d2'
  - url: 'https://git.kernel.org/stable/c/366183911b153e9b8cf758e1414e1154d7569337'
  - url: 'https://git.kernel.org/stable/c/112bb60cd0e254a369e95aa9941a694ffeca089f'
  - url: 'https://git.kernel.org/stable/c/cddea0c721106ea480371412d8de21705eb27376'
  - url: 'https://git.kernel.org/stable/c/53a0249d68a210c16e961b83adfa82f94ee0a53d'
  - url: 'https://git.kernel.org/stable/c/b5f46951e62377b6e406fadc18bc3c5bdf1632a7'
  - url: 'https://git.kernel.org/stable/c/9680c58675b82348ab84d387e4fa727f7587e1a0'
  - url: 'https://git.kernel.org/stable/c/557c024ca7250bb65ae60f16c02074106c2f197b'
tags:
  - cve.org
epss: 0.00158
epssPercentile: 0.04903
ingestedAt: '2026-10-15T22:48:25.520Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Validate i_depth for exhash directories

A fuzzer test introduced corruption that ends up with a depth of 0 in
dir_e_read(), causing an undefined shift by 32 at:

  index = hash >> (32 - dip->i_depth);

As calculated in an open-coded way in dir_make_exhash(), the minimum
depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is
invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time.

So we can avoid the undefined behaviour by checking for depth values
lower than the minimum in gfs2_dinode_in(). Values greater than the
maximum are already being checked for there.

Also switch the calculation in dir_make_exhash() to use ilog2() to
clarify how the depth is calculated.

Tested with the syzkaller repro.c and xfstests '-g quick'.

## Affected

- `Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab < 076e992752e4b24178918f748d75597c80a408d2`
- `Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab < 366183911b153e9b8cf758e1414e1154d7569337`
- `Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab < 112bb60cd0e254a369e95aa9941a694ffeca089f`
- `Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab < cddea0c721106ea480371412d8de21705eb27376`
- `Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab < 53a0249d68a210c16e961b83adfa82f94ee0a53d`
- `Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab < b5f46951e62377b6e406fadc18bc3c5bdf1632a7`
- `Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab < 9680c58675b82348ab84d387e4fa727f7587e1a0`
- `Linux >= 9a0045088d888c9c539c8c626a366cb52c0fbdab < 557c024ca7250bb65ae60f16c02074106c2f197b`
- `Linux 2.6.26`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.