CVE-2025-38663

What it actually does

Missing sanity check on inode file type during nilfs2 inode read from block device allows invalid types to reach VFS layer, triggering malfunctions or assertion failures.

Why it matters to the business

Systems using nilfs2 filesystems may experience unexpected kernel panics or filesystem errors when processing specially crafted disk images, leading to service disruption and potential data access issues until patched kernels are deployed.

How an attack unfolds

An attacker prepares a malicious nilfs2 filesystem image containing inodes with invalid file types, mounts or causes the target system to read the image, and triggers inode processing that bypasses VFS protections due to the absent validation.

How to fix it

Upgrade to Linux kernel commit dd298c0b889acd3ecaf48b6e840c9ab91882e342 or later stable releases containing the nilfs2 inode type validation; for affected Chainguard packages apply openjdk-8-openj9 updates to 0.53.0-r1 or newer that incorporate the fixed kernel.

How to confirm the fix worked

Verify kernel source contains the added file-type validity check in the nilfs2 inode read path; test by attempting to mount a crafted invalid-type inode image on a patched kernel and confirming the operation is rejected as a filesystem error rather than causing a crash.

Typical attack path

1. Craft a nilfs2 filesystem image with inodes declaring invalid file types
2. Cause the target kernel to mount or read the image via block device access
3. Trigger inode read path during normal filesystem operations or mount
4. Observe VFS malfunction or kernel assertion failure resulting from unvalidated type

How to detect it

Review kernel logs for nilfs2 filesystem error messages indicating invalid inode types; examine mount operations or block device reads involving nilfs2 images for unexpected failures around inode processing.

What your security team should do

• Prioritize kernel updates on any systems using nilfs2 filesystems within the next patching cycle
• Audit environments for nilfs2 usage and confirm fixed kernel versions are deployed
• Monitor upstream stable kernel releases for additional nilfs2 hardening patches