In the Linux kernel, the following vulnerability has been resolved:
loop: Avoid updating block size under exclusive owner
Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in _getblkslow() due to requested buffer size not matching block device block size.
Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it.
[
{
"digest": {
"length": 461.0,
"function_hash": "31264245936972008285572814915014276800"
},
"target": {
"function": "lo_simple_ioctl",
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-24925cd5",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d67b30aefeb7a949040bbb1b4e3b84c5d29a624",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"length": 515.0,
"function_hash": "295594695011392508902976933636274648195"
},
"target": {
"function": "loop_set_block_size",
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-2775b364",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@139a000d20f2f38ce34296feddd641d730fe1c08",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"length": 1276.0,
"function_hash": "188507501990841139590671067554025210768"
},
"target": {
"function": "lo_ioctl",
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-471d5feb",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d67b30aefeb7a949040bbb1b4e3b84c5d29a624",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"length": 1276.0,
"function_hash": "188507501990841139590671067554025210768"
},
"target": {
"function": "lo_ioctl",
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-4fb72560",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@139a000d20f2f38ce34296feddd641d730fe1c08",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"54006270145639258232712678123259926028",
"67949698109320507671430574426050318694",
"174881544161948290362594420650531100367",
"250446911065190293479270223885293660403",
"204579259209607078921025079616134558263",
"1800641067247099133456003968274194073",
"111887481053894900004048073554687657464",
"202788444360791074459926603664403090980",
"232388662050544519371229756794434101112",
"285602814889219604586321559980263583948",
"17213032043978626522169187108132784758",
"238555109952553345482619473610263312132",
"191936248648710586663068825820686880691",
"192841083643747254340449401580489810168",
"309407780171451000105284551236668601081",
"176279421310564828690856238024162683472",
"70722988824072824232904679171665100643",
"314194632098916757845209622618401813602",
"175490182290500824963133488171968267389",
"311325627055977572050120891466998454154",
"2603238061340304342955567696535550014",
"62693205900565684545777906678509736223",
"18145726368491730517950267126709312185",
"95257887628788937359825438954454715540",
"55263983280623908674188621226806109572",
"212235920900957758262533050616750873754",
"11016975416201544959516369154924209500",
"128613453765597848857962915232356628158"
]
},
"target": {
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-501d3b37",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d67b30aefeb7a949040bbb1b4e3b84c5d29a624",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"length": 461.0,
"function_hash": "31264245936972008285572814915014276800"
},
"target": {
"function": "lo_simple_ioctl",
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-5ad50f73",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@139a000d20f2f38ce34296feddd641d730fe1c08",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"54006270145639258232712678123259926028",
"67949698109320507671430574426050318694",
"174881544161948290362594420650531100367",
"250446911065190293479270223885293660403",
"204579259209607078921025079616134558263",
"1800641067247099133456003968274194073",
"111887481053894900004048073554687657464",
"202788444360791074459926603664403090980",
"232388662050544519371229756794434101112",
"285602814889219604586321559980263583948",
"17213032043978626522169187108132784758",
"238555109952553345482619473610263312132",
"191936248648710586663068825820686880691",
"192841083643747254340449401580489810168",
"309407780171451000105284551236668601081",
"176279421310564828690856238024162683472",
"70722988824072824232904679171665100643",
"314194632098916757845209622618401813602",
"175490182290500824963133488171968267389",
"311325627055977572050120891466998454154",
"2603238061340304342955567696535550014",
"62693205900565684545777906678509736223",
"18145726368491730517950267126709312185",
"95257887628788937359825438954454715540",
"55263983280623908674188621226806109572",
"212235920900957758262533050616750873754",
"11016975416201544959516369154924209500",
"128613453765597848857962915232356628158"
]
},
"target": {
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-5f96ad6b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b928438cc87c0bf7ae078e4b7b6e14261e84c5c5",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"length": 1276.0,
"function_hash": "188507501990841139590671067554025210768"
},
"target": {
"function": "lo_ioctl",
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-73a3e962",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b928438cc87c0bf7ae078e4b7b6e14261e84c5c5",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"length": 461.0,
"function_hash": "31264245936972008285572814915014276800"
},
"target": {
"function": "lo_simple_ioctl",
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-b9ff2e59",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b928438cc87c0bf7ae078e4b7b6e14261e84c5c5",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"length": 548.0,
"function_hash": "49528948113179479535596658771653283213"
},
"target": {
"function": "loop_set_block_size",
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-cb183857",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b928438cc87c0bf7ae078e4b7b6e14261e84c5c5",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"length": 548.0,
"function_hash": "49528948113179479535596658771653283213"
},
"target": {
"function": "loop_set_block_size",
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-f594f4ed",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d67b30aefeb7a949040bbb1b4e3b84c5d29a624",
"signature_version": "v1",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"250143815477488448708162636068760263903",
"226188801548306609397597327220216948171",
"174881544161948290362594420650531100367",
"295782714529564444884120111791821091319",
"217879429637882744267678778406676523155",
"180220420835981994038257032674185212593",
"202788444360791074459926603664403090980",
"232388662050544519371229756794434101112",
"285602814889219604586321559980263583948",
"17213032043978626522169187108132784758",
"328504104634145759834355107365378983425",
"51559314986118093218715076964028785450",
"15889404722399463274431186877073118927",
"205665191047013979150712282519026604827",
"176279421310564828690856238024162683472",
"70722988824072824232904679171665100643",
"314194632098916757845209622618401813602",
"175490182290500824963133488171968267389",
"311325627055977572050120891466998454154",
"2603238061340304342955567696535550014",
"62693205900565684545777906678509736223",
"18145726368491730517950267126709312185",
"95257887628788937359825438954454715540",
"55263983280623908674188621226806109572",
"212235920900957758262533050616750873754",
"11016975416201544959516369154924209500",
"128613453765597848857962915232356628158"
]
},
"target": {
"file": "drivers/block/loop.c"
},
"id": "CVE-2025-38709-fbc5bf73",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@139a000d20f2f38ce34296feddd641d730fe1c08",
"signature_version": "v1",
"deprecated": false
}
]