CVE-2025-38328

What it actually does

Missing error check after jffs2_prealloc_raw_node_refs allows null pointer dereference in jffs2_link_node_ref during JFFS2 garbage collection and write paths, leading to kernel crash.

Why it matters to the business

Systems using JFFS2 on embedded or flash storage may experience unexpected kernel panics during file writes or background cleanup, causing downtime and potential data loss; widespread Linux kernel usage increases exposure risk despite low exploit probability.

How an attack unfolds

An attacker with local write access to a JFFS2 filesystem triggers the flaw by performing pwritev operations that force space reservation and garbage collection; when node reference preallocation fails the subsequent dereference in link_node_ref crashes the kernel, as demonstrated in the syzkaller trace involving erase and GC paths.

How to fix it

Upgrade to fixed kernel versions: linux-lts (Alpaquita:23) 6.1.81-r0, linux-lts (Alpaquita:stream) 6.6.58-r0 or 6.12.41-r0, or mainline commit 7e860296d7808de1db175c1eda29f94a2955dcc4; rebuild and reboot systems after applying the patch that propagates allocation errors.

How to confirm the fix worked

Confirm kernel version matches a fixed release, exercise JFFS2 write and GC workloads under memory pressure, and verify absence of the null-ptr-deref KASAN report in nodelist.c:600.

Typical attack path

1. Obtain local access to write files on a JFFS2-mounted volume
2. Issue repeated or crafted pwritev/write calls to exhaust or stress node allocation
3. Force garbage collection via jffs2_reserve_space and jffs2_garbage_collect_pass
4. Trigger jffs2_erase_pending_blocks when preallocation fails
5. Reach null dereference in jffs2_link_node_ref causing kernel panic

How to detect it

Review kernel logs for KASAN null-ptr-deref reports referencing jffs2_link_node_ref, jffs2_erase_pending_blocks, or jffs2_garbage_collect_pass; correlate with JFFS2 mount points and recent pwritev or write activity from untrusted processes.

What your security team should do

• Prioritize patching all JFFS2-enabled kernels within the next maintenance window given 474 days since disclosure
• Monitor EPSS trend and threat actor mentions of related Linux kernel LPE issues for increased urgency
• Disable JFFS2 on systems where flash storage is not required or migrate to ext4 or other filesystems
• Apply the exact fixed package versions listed for each distribution variant