CVE-2025-38663

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38663
In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid file types when reading inodes To prevent inodes with invalid file types from tripping through the vfs and causing malfunctions or assertion failures, add a missing sanity check when reading an inode from a block device. If the file type is not valid, treat it as a filesystem error.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1a5c204e175a78556b8ef1f7683249fa5197295a Patch
https://git.kernel.org/stable/c/2cf0c4130bf340be3935d097a3dcbfefdcf65815 Patch
https://git.kernel.org/stable/c/42cd46b3a8b1497b9258dc7ac445dbd6beb73e2f Patch
https://git.kernel.org/stable/c/4aead50caf67e01020c8be1945c3201e8a972a27 Patch
https://git.kernel.org/stable/c/79663a15a1c70ca84f86f2dbba07b423fe7d5d4f Patch
https://git.kernel.org/stable/c/98872a934ea6a95985fb6a3655a78a5f0c114e82 Patch
https://git.kernel.org/stable/c/bf585ee198bba4ff25b0d80a0891df4656cb0d08 Patch
https://git.kernel.org/stable/c/dd298c0b889acd3ecaf48b6e840c9ab91882e342 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc7:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

07 Jan 2026, 17:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc7:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/1a5c204e175a78556b8ef1f7683249fa5197295a - () https://git.kernel.org/stable/c/1a5c204e175a78556b8ef1f7683249fa5197295a - Patch
References () https://git.kernel.org/stable/c/2cf0c4130bf340be3935d097a3dcbfefdcf65815 - () https://git.kernel.org/stable/c/2cf0c4130bf340be3935d097a3dcbfefdcf65815 - Patch
References () https://git.kernel.org/stable/c/42cd46b3a8b1497b9258dc7ac445dbd6beb73e2f - () https://git.kernel.org/stable/c/42cd46b3a8b1497b9258dc7ac445dbd6beb73e2f - Patch
References () https://git.kernel.org/stable/c/4aead50caf67e01020c8be1945c3201e8a972a27 - () https://git.kernel.org/stable/c/4aead50caf67e01020c8be1945c3201e8a972a27 - Patch
References () https://git.kernel.org/stable/c/79663a15a1c70ca84f86f2dbba07b423fe7d5d4f - () https://git.kernel.org/stable/c/79663a15a1c70ca84f86f2dbba07b423fe7d5d4f - Patch
References () https://git.kernel.org/stable/c/98872a934ea6a95985fb6a3655a78a5f0c114e82 - () https://git.kernel.org/stable/c/98872a934ea6a95985fb6a3655a78a5f0c114e82 - Patch
References () https://git.kernel.org/stable/c/bf585ee198bba4ff25b0d80a0891df4656cb0d08 - () https://git.kernel.org/stable/c/bf585ee198bba4ff25b0d80a0891df4656cb0d08 - Patch
References () https://git.kernel.org/stable/c/dd298c0b889acd3ecaf48b6e840c9ab91882e342 - () https://git.kernel.org/stable/c/dd298c0b889acd3ecaf48b6e840c9ab91882e342 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory

03 Nov 2025, 18:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -

28 Aug 2025, 15:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: rechaza tipos de archivo no válidos al leer inodos. Para evitar que los inodos con tipos de archivo no válidos se filtren en el sistema de archivos virtual (VFS) y provoquen fallos de funcionamiento o de aserción, se ha añadido una comprobación de depuración al leer un inodo desde un dispositivo de bloque. Si el tipo de archivo no es válido, se considera un error del sistema de archivos.
References
  • () https://git.kernel.org/stable/c/2cf0c4130bf340be3935d097a3dcbfefdcf65815 -
  • () https://git.kernel.org/stable/c/98872a934ea6a95985fb6a3655a78a5f0c114e82 -
  • () https://git.kernel.org/stable/c/dd298c0b889acd3ecaf48b6e840c9ab91882e342 -

22 Aug 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-22 16:15

Updated : 2026-01-07 17:35

NVD link : CVE-2025-38663

Mitre link : CVE-2025-38663

CVE.ORG link : CVE-2025-38663

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
NVD-CWE-noinfo