CVE-2025-38194

What it actually does

Missing validation of the return value from jffs2_prealloc_raw_node_refs in jffs2_sum_write_sumnode allows an error path to reach jffs2_link_node_ref, triggering a kernel BUG at fs/jffs2/nodelist.c:592 during JFFS2 summary writes.

Why it matters to the business

Embedded or flash-based Linux systems using JFFS2 may suffer sudden kernel crashes during file writes or sendfile operations, causing downtime and loss of service availability; low EPSS and absence from KEV indicate limited immediate risk but 480 days of exposure increases cumulative exposure across the ecosystem.

How an attack unfolds

An attacker performs file writes or splice/sendfile operations that invoke JFFS2 space reservation and summary writing; fault injection or crafted conditions cause preallocation to fail, the unchecked error propagates, and jffs2_link_node_ref hits the invalid state leading to BUG. Related Linux kernel privilege-escalation campaigns targeting similar JFFS2 and filesystem paths may attempt to chain this for denial of service or further exploitation.

How to fix it

Apply the upstream fix (commit 337f80f3d546e131c7aa90b61d8cde051ae858c7) or upgrade affected packages to the listed fixed versions: kube-fluentd-operator and variants to 1.18.2-r40; rebuild or patch any custom kernels containing the vulnerable jffs2 summary code.

How to confirm the fix worked

Verify the presence of the check on jffs2_prealloc_raw_node_refs return value in summary.c; confirm the fixed commit or package version is deployed and that syzkaller-style write/splice workloads no longer produce the nodelist.c:592 BUG.

Typical attack path

1. Mount a JFFS2 filesystem
2. Perform iterative file writes or splice operations to trigger summary node writes
3. Force preallocation failure via memory pressure or fault injection
4. Reach jffs2_sum_write_sumnode without checking prealloc result
5. Trigger BUG in jffs2_link_node_ref during node linking

How to detect it

Search kernel logs and crash dumps for "kernel BUG at fs/jffs2/nodelist.c:592" and "jffs2_link_node_ref"; correlate with JFFS2 mount and write activity in audit or syscall logs; review threat actor reports of Linux kernel privilege-escalation attempts involving filesystem paths.

• kernel BUG at fs/jffs2/nodelist.c:592
• jffs2_link_node_ref+0x570/0x690
• jffs2_sum_write_sumnode+0xd1a/0x1da0
• invalid opcode: 0000 [#1] PREEMPT SMP KASAN

What your security team should do

• Immediately inventory all systems running vulnerable JFFS2 kernels and schedule upgrades to the listed fixed versions
• Prioritize patching for any embedded or IoT devices using JFFS2 given the 480-day exposure window
• Add kernel crash monitoring for jffs2 BUG signatures and review EPSS trend for any future increase