In the Linux kernel, the following vulnerability has been resolved:
Squashfs: check return result of sbminblocksize
Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfsbioread" bug.
Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOPSETBLOCKSIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfsfill_super() fails.
msblk->devblksize = sbminblocksize(sb, SQUASHFSDEVBLKSIZE);
sbminblocksize() returns 0, which means msblk->devblksize is set to 0.
As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64.
This subsequently causes the
UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long')
This commit adds a check for a 0 return by sbminblocksize().
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13681385609352075676659604632898420295",
"290966426458622842905636736475062317586",
"333726604313851232760192842023160582536",
"325192101403060020514640098294385481952"
]
},
"target": {
"file": "fs/squashfs/super.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f99357dadbf9c979ad737156ad4c37fadf7c56b",
"id": "CVE-2025-38415-07d6a715",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "338702861329101805866819192316052765996",
"length": 6992.0
},
"target": {
"file": "fs/squashfs/super.c",
"function": "squashfs_fill_super"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abf6b78c6fb112eee495f5636ffcc350dd2ce25",
"id": "CVE-2025-38415-3e449855",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "56442780668167955426024868242219725729",
"length": 7686.0
},
"target": {
"file": "fs/squashfs/super.c",
"function": "squashfs_fill_super"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282",
"id": "CVE-2025-38415-5667fba4",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146712078645354964931958175754031432053",
"159544887500319028263178603718217563785",
"116196360306266814884956464869152296979",
"325192101403060020514640098294385481952"
]
},
"target": {
"file": "fs/squashfs/super.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@549f9e3d7b60d53808c98b9fde49b4f46d0524a5",
"id": "CVE-2025-38415-68077744",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "270772870623119155805727854400802331056",
"length": 7542.0
},
"target": {
"file": "fs/squashfs/super.c",
"function": "squashfs_fill_super"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0aff95d9bc7fb5400ca8af507429c4b067bdb425",
"id": "CVE-2025-38415-ae17446b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "24937988161116821401307886402564383199",
"length": 6903.0
},
"target": {
"file": "fs/squashfs/super.c",
"function": "squashfs_fill_super"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@549f9e3d7b60d53808c98b9fde49b4f46d0524a5",
"id": "CVE-2025-38415-c283f8ee",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "270772870623119155805727854400802331056",
"length": 7542.0
},
"target": {
"file": "fs/squashfs/super.c",
"function": "squashfs_fill_super"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f99357dadbf9c979ad737156ad4c37fadf7c56b",
"id": "CVE-2025-38415-c55eba51",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169813988701208228759836507371027222273",
"158523551420020611962185964761319554748",
"333726604313851232760192842023160582536",
"325192101403060020514640098294385481952"
]
},
"target": {
"file": "fs/squashfs/super.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abf6b78c6fb112eee495f5636ffcc350dd2ce25",
"id": "CVE-2025-38415-c9fc0eaa",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13681385609352075676659604632898420295",
"290966426458622842905636736475062317586",
"333726604313851232760192842023160582536",
"325192101403060020514640098294385481952"
]
},
"target": {
"file": "fs/squashfs/super.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295ab18c2dbce8d0ac6ecf7c5187e16e1ac8b282",
"id": "CVE-2025-38415-e3f9711e",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"13681385609352075676659604632898420295",
"290966426458622842905636736475062317586",
"333726604313851232760192842023160582536",
"325192101403060020514640098294385481952"
]
},
"target": {
"file": "fs/squashfs/super.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0aff95d9bc7fb5400ca8af507429c4b067bdb425",
"id": "CVE-2025-38415-f263d792",
"deprecated": false,
"signature_version": "v1"
}
]