CVE-2025-22079

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22079
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH. Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/11e24802e73362aa2948ee16b8fb4e32635d5b2a Patch
https://git.kernel.org/stable/c/17c99ab3db2ba74096d36c69daa6e784e98fc0b8 Patch
https://git.kernel.org/stable/c/3d012ba4404a0bb517658699ba85e6abda386dc3 Patch
https://git.kernel.org/stable/c/49d2a2ea9d30991bae82107f9523915b91637683 Patch
https://git.kernel.org/stable/c/538ed8b049ef801a86c543433e5061a91cc106e3 Patch
https://git.kernel.org/stable/c/a406aff8c05115119127c962cbbbbd202e1973ef Patch
https://git.kernel.org/stable/c/b942f88fe7d2d789e51c5c30a675fa1c126f5a6d Patch
https://git.kernel.org/stable/c/e95d97c9c8cd0c239b7b59c79be0f6a9dcf7905c Patch
https://git.kernel.org/stable/c/ef34840bda333fe99bafbd2d73b70ceaaf9eba66 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

31 Oct 2025, 20:59

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ocfs2: Validar l_tree_depth para evitar accesos fuera de los límites. El campo l_tree_depth es de 16 bits (__le16), pero la profundidad máxima real está limitada a OCFS2_MAX_PATH_DEPTH. Se ha añadido una comprobación para evitar accesos fuera de los límites si l_tree_depth tiene un valor no válido, lo que puede ocurrir al leer desde un disco montado dañado [1].
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
First Time Linux linux Kernel
Linux
CWE CWE-125
References () https://git.kernel.org/stable/c/11e24802e73362aa2948ee16b8fb4e32635d5b2a - () https://git.kernel.org/stable/c/11e24802e73362aa2948ee16b8fb4e32635d5b2a - Patch
References () https://git.kernel.org/stable/c/17c99ab3db2ba74096d36c69daa6e784e98fc0b8 - () https://git.kernel.org/stable/c/17c99ab3db2ba74096d36c69daa6e784e98fc0b8 - Patch
References () https://git.kernel.org/stable/c/3d012ba4404a0bb517658699ba85e6abda386dc3 - () https://git.kernel.org/stable/c/3d012ba4404a0bb517658699ba85e6abda386dc3 - Patch
References () https://git.kernel.org/stable/c/49d2a2ea9d30991bae82107f9523915b91637683 - () https://git.kernel.org/stable/c/49d2a2ea9d30991bae82107f9523915b91637683 - Patch
References () https://git.kernel.org/stable/c/538ed8b049ef801a86c543433e5061a91cc106e3 - () https://git.kernel.org/stable/c/538ed8b049ef801a86c543433e5061a91cc106e3 - Patch
References () https://git.kernel.org/stable/c/a406aff8c05115119127c962cbbbbd202e1973ef - () https://git.kernel.org/stable/c/a406aff8c05115119127c962cbbbbd202e1973ef - Patch
References () https://git.kernel.org/stable/c/b942f88fe7d2d789e51c5c30a675fa1c126f5a6d - () https://git.kernel.org/stable/c/b942f88fe7d2d789e51c5c30a675fa1c126f5a6d - Patch
References () https://git.kernel.org/stable/c/e95d97c9c8cd0c239b7b59c79be0f6a9dcf7905c - () https://git.kernel.org/stable/c/e95d97c9c8cd0c239b7b59c79be0f6a9dcf7905c - Patch
References () https://git.kernel.org/stable/c/ef34840bda333fe99bafbd2d73b70ceaaf9eba66 - () https://git.kernel.org/stable/c/ef34840bda333fe99bafbd2d73b70ceaaf9eba66 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

16 Apr 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 15:16

Updated : 2025-10-31 20:59

NVD link : CVE-2025-22079

Mitre link : CVE-2025-22079

CVE.ORG link : CVE-2025-22079

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read