CVE-2025-38382 Details
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix iteration of extrefs during log replay At __inode_add_ref() when processing extrefs, if we jump into the next label we have an undefined value of victim_name.len, since we haven't initialized it before we did the goto. This results in an invalid memory access in the next iteration of the loop since victim_name.len was not initialized to the length of the name of the current extref. Fix this by initializing victim_name.len with the current extref's name length.
A vulnerability in the Linux kernel's Btrfs file system has been addressed, which involved an invalid memory access during log replay. The issue arose in the __inode_add_ref() function while processing extended references (extrefs). If the function jumped to a certain label without properly initializing the length of the victim name, it led to undefined behavior. This, in turn, caused an invalid memory access in the subsequent iteration of the loop. The vulnerability has been fixed by ensuring that the victim name length is correctly initialized with the length of the current extref's name before the function jumps to the next label.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2d11d274e2e1d7c79e2ca8461ce3ff3a95c11171 | kernel.org | Patch |
| https://git.kernel.org/stable/c/539969fc472886a1d63565459514d47e27fef461 | kernel.org | Patch |
| https://git.kernel.org/stable/c/54a7081ed168b72a8a2d6ef4ba3a1259705a2926 | kernel.org | Patch |
| https://git.kernel.org/stable/c/7ac790dc2ba00499a8d671d4a24de4d4ad27e234 | kernel.org | Patch |
| https://git.kernel.org/stable/c/aee57a0293dca675637e5504709f9f8fd8e871be | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.1.57, < 6.1.144 >= 6.2, < 6.6.97 >= 6.7, < 6.12.37 >= 6.13, < 6.15.6 6.16 rc1 6.16 rc2 6.16 rc3 6.16 rc4 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Dec 16, 2025 | Reanalysis | [email protected] |
| Dec 15, 2025 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Jul 25, 2025 | New CVE Received | kernel.org |