Threats tagged 'ghsa-m2xx-pr2p-6vvw'

CVE-2025-38221 is a high-severity vulnerability in the Linux kernel's ext4 filesystem driver. It involves an out-of-bounds punch offset when punching holes in files, which can cause a negative length calculation in the truncate_inode_partial_folio() function. This flaw can lead to kernel crashes (BUG) and denial of service. The issue arises when the punch start offset exceeds the maximum allowed end offset. The vulnerability has been fixed by adding a check to prevent punching holes beyond the max_end boundary.