CVE-2025-38163 – This CVE describes a NULL pointer dereference v... (How to Fix)

Q: What is the severity of CVE-2025-38163?

CVE-2025-38163 has a CVSS score of 5.5 (MEDIUM). This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's F2FS filesystem driver. When processing a specially crafted filesystem image, the kernel can crash due to an inconsistency between the total valid block count and actual mapped blocks, leading to a denial of service. This affects any system using the F2FS filesystem with a vulnerable kernel version.

📋 TL;DR

This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's F2FS filesystem driver. When processing a specially crafted filesystem image, the kernel can crash due to an inconsistency between the total valid block count and actual mapped blocks, leading to a denial of service. This affects any system using the F2FS filesystem with a vulnerable kernel version.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions with vulnerable F2FS implementation (check git commits for exact ranges)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems using F2FS filesystem. Many distributions don't enable F2FS by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data loss or corruption if the crash occurs during critical operations.

🟠

Likely Case

System crash requiring reboot when a malicious or corrupted F2FS filesystem image is mounted or accessed.

🟢

If Mitigated

Limited impact if systems don't use F2FS or have proper input validation for filesystem images.

🌐 Internet-Facing: LOW - Requires local filesystem access or ability to mount crafted images, not typically exploitable over network.

🏢 Internal Only: MEDIUM - Could be exploited by users with local access to mount malicious filesystem images or through privilege escalation chains.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to create/mount malicious F2FS filesystem images. Found through fuzzing (syzbot).

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 05872a167c2cab80ef186ef23cc34a6776a1a30c and related fixes

Vendor Advisory: https://git.kernel.org/stable/c/05872a167c2cab80ef186ef23cc34a6776a1a30c

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Rebuild kernel if compiling from source with the fix commits. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable F2FS module

linux

Prevent loading of F2FS kernel module if not needed

echo 'blacklist f2fs' > /etc/modprobe.d/f2fs-blacklist.conf
rmmod f2fs

Avoid untrusted F2FS images

all

Do not mount F2FS filesystem images from untrusted sources

🧯 If You Can't Patch

Restrict mount permissions to prevent non-privileged users from mounting filesystems
Implement strict access controls on directories where F2FS images might be stored

🔍 How to Verify

Check if Vulnerable:

Check if F2FS module is loaded: lsmod | grep f2fs. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Test with known vulnerable F2FS image if available.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages mentioning f2fs
BUG at fs/f2fs/f2fs.h:2521
dec_valid_block_count+0x3b2/0x3c0 in stack traces

SIEM Query:

source="kernel" AND ("f2fs" AND ("panic" OR "BUG" OR "Oops"))

📊 Metadata

CVE ID: CVE-2025-38163

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.03% exploit probability (8.7th percentile)

Published: July 3, 2025

Last Updated: December 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38163, you might also want to check these: