CVE-2025-38652: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38652 is an out-of-bounds read vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation, specifically in the handling of device paths (devs.path). When a device path length equals MAX_PATH_LEN, the path array is fully filled without a null terminator, causing adjacent structure fields to be incorrectly interpreted as part of the device path string during mount operations. The vulnerability affects Linux kernel versions from 4.10 through 6.16.0 across multiple stable branches, as well as Debian Linux 11.0. It was published on August 22, 2025, and carries a CVSS v3.1 base score of 7.1 (High) (Feedly, ENISA EUVD).

The root cause is classified as CWE-125 (Out-of-bounds Read). In the f2fs_dev_info structure, the path field is declared as char path[MAX_PATH_LEN]. When a device path exactly fills this array, no space remains for a null terminator, causing the kernel to read beyond the intended boundary into adjacent structure fields when parsing the device path string. An attacker with local privileges can trigger this by creating an F2FS filesystem using mkfs.f2fs with a device filename of exactly MAX_PATH_LEN characters and then mounting it, as demonstrated in the kernel bug report. The fix adds one additional byte to sbi->devs.path[] to ensure the null terminator is always stored (Feedly, ENISA EUVD).

Successful exploitation can expose sensitive kernel memory contents adjacent to the path[] field in the f2fs_dev_info structure, constituting a confidentiality breach. Additionally, the malformed device path parsing causes mount operations to fail, impacting system availability. The vulnerability is locally scoped with no integrity impact, but the combination of potential kernel memory disclosure and denial-of-service through failed mounts makes it significant on systems where F2FS is used (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of publication. The vulnerability requires local access with low privileges to exploit, limiting its attack surface. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, ENISA EUVD).

1. Gain local access: Obtain a local user account on a system running a vulnerable Linux kernel version (4.10–5.4.296, 5.5–5.10.240, 5.11–5.15.189, 5.16–6.1.147, 6.2–6.6.101, 6.7–6.12.41, 6.13–6.15.9, or 6.16.0) with F2FS support enabled.
2. Create a maximum-length filename: Create a file whose name is exactly MAX_PATH_LEN characters long (e.g., a 56-character name as shown in the kernel bug report): touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123
3. Prepare a secondary device file: Create and size a secondary file to serve as the companion device: touch /mnt/f2fs/file && truncate -s $((1024*1024*1024)) /mnt/f2fs/file
4. Format with mkfs.f2fs: Use mkfs.f2fs with the -c option to create a multi-device F2FS filesystem using the maximum-length path file as the primary device and the secondary file as a companion device.
5. Mount the filesystem: Mount the crafted filesystem. The kernel's F2FS mount code reads sbi->devs.path[] without a null terminator, causing an out-of-bounds read into adjacent kernel memory, potentially exposing sensitive data or causing a mount failure (Feedly, ENISA EUVD).

• Logs: Kernel log messages such as F2FS-fs (loopX): Mount Device [ 0]: <long_path>\xff\x01 followed by F2FS-fs (loopX): Failed to find devices, indicating malformed device path parsing during F2FS mount operations.
• File System: Presence of files with names exactly at MAX_PATH_LEN characters in length on F2FS-mounted volumes, particularly when combined with mkfs.f2fs usage involving the -c (companion device) option.
• Process: Unexpected invocations of mkfs.f2fs with maximum-length filenames as device arguments by non-root local users, or unusual mount system calls targeting F2FS filesystems with atypically long device paths (Feedly).

Patches are available across all affected stable kernel branches. Administrators should update to the following fixed versions or later: 5.4.297, 5.10.241, 5.15.190, 6.1.148, 6.6.102, 6.12.42, 6.15.10, and 6.16.1 (Feedly, ENISA EUVD). Ubuntu users should apply the updates provided in security notices USN-7909-1, USN-7909-3, USN-7910-1, USN-7910-2, USN-7933-1, and USN-7938-1 (Ubuntu USN-7909-1, Ubuntu USN-7938-1). As a temporary workaround for systems that cannot be patched immediately, restrict local user access and disable F2FS filesystem support if it is not operationally required.

The vulnerability received routine coverage from Linux security tracking outlets including LinuxSecurity.com, Pro-Linux.de, and LinuxCompatible.org, primarily in the context of kernel update advisories for Ubuntu, SUSE, and Oracle Linux distributions. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries and vendor patch notifications (Feedly).