Cloudanix VulnDB

CVE-2025-38230

None

CVSS

—

EPSS

0.2%

Published

Jul 4, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's JFS file-system code can let bad internal numbers cause the system to crash when certain disk-maintenance commands run.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Invalid AG parameters (db_agheight, db_agwidth, db_agstart) from corrupted JFS metadata cause a negative shift exponent in dbAllocAG, triggering UBSAN shift-out-of-bounds and undefined behavior during allocation or discard operations.

Why it matters to the business

Unpatched systems using JFS may experience kernel crashes or instability during file-system maintenance operations such as discard or ioctl, leading to downtime and potential data access loss until the filesystem is repaired or the kernel is updated.

How an attack unfolds

An attacker supplies a JFS filesystem image with crafted or corrupted AG parameter values that bypass earlier checks; when a privileged process issues an ioctl or trim operation, dbMount loads the bad values and dbAllocAG performs an out-of-bounds shift, crashing the kernel.

How to fix it

Update the Linux kernel to commit 95ae5ee6069d9a5945772625f289422ef659221a or later; for Chainguard images use request-1279 or request-1279-compat version 1.23.1-r1 or newer. Reboot after upgrade and verify the JFS module is loaded from the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 95ae5ee6069d9a5945772625f289422ef659221a; attempt to mount a test JFS image containing out-of-range AG parameters and verify no UBSAN shift violation occurs in dmesg.

Typical attack path

  1. Mount a malicious or corrupted JFS volume
  2. Trigger jfs_ioc_trim or equivalent ioctl path
  3. dbMount accepts invalid agheight/agwidth/agstart values
  4. dbAllocAG executes shift with negative exponent
  5. Kernel hits UBSAN handler and panics

How to detect it

Search kernel logs for UBSAN shift-out-of-bounds messages referencing jfs_dmap.c:1400 and dbAllocAG; inspect mounts of JFS volumes followed by ioctl or trim activity.

What your security team should do

  • Prioritize kernel updates on all systems that mount JFS volumes
  • Disable JFS support via kernel config if the filesystem is not required
  • Add monitoring for JFS-related UBSAN or shift errors in system logs
  • Test patched kernels with Syzkaller-style fuzzing before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount() to prevent crashes Validate db_agheight, db_agwidth, and db_agstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL, LPERCTL/MAXAG, and CTLTREESIZE: - agheight: 0 to L2LPERCTL/2 (0 to 5) ensures shift (L2LPERCTL - 2*agheight) >= 0. - agwidth: 1 to min(LPERCTL/MAXAG, 2^(L2LPERCTL - 2*agheight)) ensures agperlev >= 1. - Ranges: 1-8 (agheight 0-3), 1-4 (agheight 4), 1 (agheight 5). - LPERCTL/MAXAG = 1024/128 = 8 limits leaves per AG; 2^(10 - 2*agheight) prevents division to 0. - agstart: 0 to CTLTREESIZE-1 - agwidth*(MAXAG-1) keeps ti within stree (size 1365). - Ranges: 0-1237 (agwidth 1), 0-348 (agwidth 8). UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:1400:9 shift exponent -335544310 is negative CPU: 0 UID: 0 PID: 5822 Comm: syz-executor130 Not tainted 6.14.0-rc5-syzkaller #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 dbAllocAG+0x1087/0x10b0 fs/jfs/jfs_dmap.c:1400 dbDiscardAG+0x352/0xa20 fs/jfs/jfs_dmap.c:1613 jfs_ioc_trim+0x45a/0x6b0 fs/jfs/jfs_discard.c:105 jfs_ioctl+0x2cd/0x3e0 fs/jfs/ioctl.c:131 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 No fix
Debian:14 linux 0 6.12.37-1
Linux Kernel 2.6.12 5.4.296

Related vulnerabilities