CVE-2025-38709
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size. Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-09-04 16:15:39.997000
Last modified
2026-10-30 13:18:07.650000
View original CVE JSON
{
"id": "CVE-2025-38709",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-04T16:15:39.997",
"lastModified": "2026-10-30T13:18:07.650",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nloop: Avoid updating block size under exclusive owner\n\nSyzbot came up with a reproducer where a loop device block size is\nchanged underneath a mounted filesystem. This causes a mismatch between\nthe block device block size and the block size stored in the superblock\ncausing confusion in various places such as fs/buffer.c. The particular\nissue triggered by syzbot was a warning in __getblk_slow() due to\nrequested buffer size not matching block device block size.\n\nFix the problem by getting exclusive hold of the loop device to change\nits block size. This fails if somebody (such as filesystem) has already\nan exclusive ownership of the block device and thus prevents modifying\nthe loop device under some exclusive owner which doesn't expect it."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nloop: Evitar actualizar el tamaño de bloque bajo propietario exclusivo\n\nSyzbot encontró un reproductor donde el tamaño de bloque de un dispositivo loop es cambiado bajo un sistema de archivos montado. Esto causa un desajuste entre el tamaño de bloque del dispositivo de bloques y el tamaño de bloque almacenado en el superbloque, causando confusión en varios lugares como fs/buffer.c. El problema particular desencadenado por syzbot fue una advertencia en __getblk_slow() debido a que el tamaño de búfer solicitado no coincidía con el tamaño de bloque del dispositivo de bloques.\n\nSolucionar el problema adquiriendo un control exclusivo del dispositivo loop para cambiar su tamaño de bloque. Esto falla si alguien (como un sistema de archivos) ya tiene una propiedad exclusiva del dispositivo de bloques y, por lo tanto, evita modificar el dispositivo loop bajo algún propietario exclusivo que no lo espera."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/block/loop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "89e4fdecb51cf5535867026274bc97de9480ade5",
"lessThan": "46034518cae95db4abfde990c9ca1a0751855072",
"versionType": "git",
"status": "affected"
},
{
"version": "89e4fdecb51cf5535867026274bc97de9480ade5",
"lessThan": "457d2c5e112fd08dc1039b1ae39a83ec1782360d",
"versionType": "git",
"status": "affected"
},
{
"version": "89e4fdecb51cf5535867026274bc97de9480ade5",
"lessThan": "139a000d20f2f38ce34296feddd641d730fe1c08",
"versionType": "git",
"status": "affected"
},
{
"version": "89e4fdecb51cf5535867026274bc97de9480ade5",
"lessThan": "b928438cc87c0bf7ae078e4b7b6e14261e84c5c5",
"versionType": "git",
"status": "affected"
},
{
"version": "89e4fdecb51cf5535867026274bc97de9480ade5",
"lessThan": "5d67b30aefeb7a949040bbb1b4e3b84c5d29a624",
"versionType": "git",
"status": "affected"
},
{
"version": "89e4fdecb51cf5535867026274bc97de9480ade5",
"lessThan": "7e49538288e523427beedd26993d446afef1a6fb",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/block/loop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.14",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.14",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.109",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.43",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.15.11",
"lessThanOrEqual": "6.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16.2",
"lessThanOrEqual": "6.16.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.109",
"matchCriteriaId": "9287A2A2-253D-4FC0-8D89-A750A3B30239"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.43",
"matchCriteriaId": "472C5F87-2BF3-4FAB-9B21-DA7513977363"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.15.11",
"matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16",
"versionEndExcluding": "6.16.2",
"matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/139a000d20f2f38ce34296feddd641d730fe1c08",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/457d2c5e112fd08dc1039b1ae39a83ec1782360d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/46034518cae95db4abfde990c9ca1a0751855072",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5d67b30aefeb7a949040bbb1b4e3b84c5d29a624",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/7e49538288e523427beedd26993d446afef1a6fb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/b928438cc87c0bf7ae078e4b7b6e14261e84c5c5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}