7.8

CVE-2025-22079: linux Out-of-bounds Read

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2025-22079DEBIAN-CVE-2025-22079
Published 16-04-2025Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2025-22079 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.3% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 43 · Related 38
DLA-4178-1DLA-4193-1DSA-5907-1MGASA-2025-0142MGASA-2025-0146USN-7585-1

Timeline

  1. 16-04-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH. Add a check to prevent out-of-bounds access if l_tree_depth has an invalid value, which may occur when reading from a corrupted mounted disk [1].

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

0.00 pp

From 0.25% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu137 products
  • linuxAll versions (No fix recorded) | < 5.4.0-218.238 | < 5.15.0-142.152 | < 6.8.0-86.87
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1147.157 | < 5.15.0-1086.93 | < 6.8.0-1041.43
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ ccd979bdbce9fba8412beb3f1de68a9d0171b12c, < ef34840bda333fe99bafbd2d73b70ceaaf9eba66 | ≥ ccd979bdbce9fba8412beb3f1de68a9d0171b12c, < 538ed8b049ef801a86c543433e5061a91cc106e3 | ≥ ccd979bdbce9fba8412beb3f1de68a9d0171b12c, < 17c99ab3db2ba74096d36c69daa6e784e98fc0b8 | ≥ ccd979bdbce9fba8412beb3f1de68a9d0171b12c, < 11e24802e73362aa2948ee16b8fb4e32635d5b2a | ≥ ccd979bdbce9fba8412beb3f1de68a9d0171b12c, < 3d012ba4404a0bb517658699ba85e6abda386dc3 | ≥ ccd979bdbce9fba8412beb3f1de68a9d0171b12c, < 49d2a2ea9d30991bae82107f9523915b91637683 | ≥ ccd979bdbce9fba8412beb3f1de68a9d0171b12c, < b942f88fe7d2d789e51c5c30a675fa1c126f5a6d | ≥ ccd979bdbce9fba8412beb3f1de68a9d0171b12c, < e95d97c9c8cd0c239b7b59c79be0f6a9dcf7905c | ≥ ccd979bdbce9fba8412beb3f1de68a9d0171b12c, < a406aff8c05115119127c962cbbbbd202e1973ef | 2.6.16
  • linux_kernel≥ 2.6.16, < 5.4.292 | ≥ 5.5, < 5.10.236 | ≥ 5.11, < 5.15.180 | ≥ 5.16, < 6.1.134 | ≥ 6.2, < 6.6.87 | ≥ 6.7, < 6.12.23 | ≥ 6.13, < 6.13.11 | ≥ 6.14, < 6.14.2
Debian1 product
  • linux< 6.1.135-1 | < 6.12.25-1

3 vendors · 140 products

References

54 links
Show all 54 references