CVE-2025-38659

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38659
In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. Not only is that a very bad idea, it has also never worked because gfs2_recover_func() will refuse to do anything during a withdraw. However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before commit 04133b607a78 ("gfs2: Prevent double iput for journal on error") and is a NULL pointer dereference since then. Simply get rid of self recovery to fix that.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1a91ba12abef628b43cada87478328274d988e88 Patch
https://git.kernel.org/stable/c/6784367b2f3cd7b89103de35764f37f152590dbd Patch
https://git.kernel.org/stable/c/97c94c7dbddc34d353c83b541b3decabf98d04af Patch
https://git.kernel.org/stable/c/deb016c1669002e48c431d6fd32ea1c20ef41756 Patch
https://git.kernel.org/stable/c/f5426ffbec971a8f7346a57392d3a901bdee5a9b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

26 Nov 2025, 16:32

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-476
References () https://git.kernel.org/stable/c/1a91ba12abef628b43cada87478328274d988e88 - () https://git.kernel.org/stable/c/1a91ba12abef628b43cada87478328274d988e88 - Patch
References () https://git.kernel.org/stable/c/6784367b2f3cd7b89103de35764f37f152590dbd - () https://git.kernel.org/stable/c/6784367b2f3cd7b89103de35764f37f152590dbd - Patch
References () https://git.kernel.org/stable/c/97c94c7dbddc34d353c83b541b3decabf98d04af - () https://git.kernel.org/stable/c/97c94c7dbddc34d353c83b541b3decabf98d04af - Patch
References () https://git.kernel.org/stable/c/deb016c1669002e48c431d6fd32ea1c20ef41756 - () https://git.kernel.org/stable/c/deb016c1669002e48c431d6fd32ea1c20ef41756 - Patch
References () https://git.kernel.org/stable/c/f5426ffbec971a8f7346a57392d3a901bdee5a9b - () https://git.kernel.org/stable/c/f5426ffbec971a8f7346a57392d3a901bdee5a9b - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gfs2: No más autorrecuperación. Cuando un nodo se retira y resulta ser el único que tiene montado el sistema de archivos, gfs2 intenta reproducir el diario local para restablecer la consistencia del sistema de archivos. Esto no solo es una pésima idea, sino que nunca ha funcionado, ya que gfs2_recover_func() se niega a hacer nada durante una retirada. Sin embargo, incluso antes de llegar a este punto, gfs2_recover_func() desreferencia sdp->sd_jdesc->jd_inode. Esto era un use-after-free antes del commit 04133b607a78 ("gfs2: Evitar doble entrada para el diario en caso de error") y, desde entonces, es una desreferencia de puntero nulo. Simplemente elimine la autorrecuperación para solucionarlo.
First Time Linux
Linux linux Kernel

22 Aug 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-22 16:15

Updated : 2025-11-26 16:32

NVD link : CVE-2025-38659

Mitre link : CVE-2025-38659

CVE.ORG link : CVE-2025-38659

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference