CVE-2025-38710

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Validate i_depth for exhash directories

A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at:

index = hash >> (32 - dip->i_depth);

As calculated in an open-coded way in dir_make_exhash(), the minimum depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time.

So we can avoid the undefined behaviour by checking for depth values lower than the minimum in gfs2_dinode_in(). Values greater than the maximum are already being checked for there.

Also switch the calculation in dir_make_exhash() to use ilog2() to clarify how the depth is calculated.

Tested with the syzkaller repro.c and xfstests '-g quick'.

This vulnerability is rated as Moderate impact because exploiting it requires mounting a specifically corrupted GFS2 filesystem image, an action that necessitates local administrative access or raw block device access. In standard Red Hat Enterprise Linux deployments, unprivileged users lack the permissions required to mount cluster filesystems or manipulate storage volumes directly. Consequently, this flaw cannot be triggered remotely or by unprivileged local accounts under default configurations, confining the risk to a localized denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.