CVE-2025-38204

What it actually does

Out-of-bounds array read in JFS add_missing_indices due to s8 stbl array holding offsets that can exceed 127 without bounds validation, allowing invalid slot access before the added -EIO check.

Why it matters to the business

Kernel memory corruption risk on systems mounting JFS filesystems can lead to crashes, data inconsistency, or local privilege escalation; low exploit probability but rising EPSS and presence in container images increases exposure for affected Linux deployments.

How an attack unfolds

An attacker with local access crafts or corrupts a JFS filesystem image containing invalid stbl offsets, mounts it, and triggers readdir operations that call add_missing_indices; failure to validate allows out-of-bounds read that can be leveraged for further kernel memory access in privilege escalation scenarios similar to other listed Linux kernel flaws.

How to fix it

Upgrade affected Linux kernels to the fixed commit 81af4b34fd72d390d7f237c6a545cc6d09707956; for Chainguard kubernetes-fips-1.30 images apply the version containing the JFS patch or migrate to unaffected releases; disable JFS module if unused.

How to confirm the fix worked

Verify kernel source contains the bounds check returning -EIO in add_missing_indices and that jfs_readdir propagates errors; confirm running kernel version includes commit 81af4b34fd72d390d7f237c6a545cc6d09707956 via uname or package metadata.

Typical attack path

1. Obtain local code execution or shell on target system
2. Prepare malicious JFS filesystem image with oversized stbl offsets
3. Mount the image and invoke directory operations triggering jfs_readdir
4. Trigger the missing bounds check path to perform out-of-bounds read
5. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Search kernel logs for JFS-related EIO returns from readdir or add_missing_indices failures; inspect mounted JFS volumes for corruption indicators and review audit logs for unusual mount or directory traversal activity by untrusted processes.

What your security team should do

• Prioritize kernel updates on any systems using JFS filesystems within 30 days given rising EPSS
• Audit for JFS usage in container base images and replace with ext4 or xfs where possible
• Monitor for kernel oops or EIO errors during directory enumeration on JFS volumes
• Apply defense-in-depth with LSMs and restrict unprivileged mounts