CVE-2025-38652

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid out-of-boundary access in devs.path

• touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123
• truncate -s $((102410241024))
  /mnt/f2fs/012345678901234567890123456789012345678901234567890123
• touch /mnt/f2fs/file
• truncate -s $((102410241024)) /mnt/f2fs/file
• mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123
  -c /mnt/f2fs/file
• mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123
  /mnt/f2fs/loop

[16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\xff\x01, 511, 0 - 3ffff [16937.192268] F2FS-fs (loop0): Failed to find devices

If device path length equals to MAX_PATH_LEN, sbi->devs.path[] may not end up w/ null character due to path array is fully filled, So accidently, fields locate after path[] may be treated as part of device path, result in parsing wrong device path.

struct f2fs_dev_info { ... char path[MAX_PATH_LEN]; ... };

Let's add one byte space for sbi->devs.path[] to store null character of device path string.

This vulnerability poses no risk to Red Hat Enterprise Linux as the Flash-Friendly File System (F2FS) is not enabled or supported in Red Hat kernels. In upstream Linux environments, local users could potentially trigger an out-of-bounds read leading to system instability or memory disclosure when mounting a multi-device volume with a device path that reaches the maximum buffer limit. Because the required file system code is not included in supported Red Hat Enterprise Linux distributions, standard installations are not exposed to this flaw.