CVE-2025-38698

What it actually does

The flaw permits opening a JFS regular file whose on-disk i_size value is negative, bypassing corruption validation and allowing subsequent read/write operations to fail or behave unexpectedly.

Why it matters to the business

Systems relying on the JFS filesystem may encounter crashes or data-handling failures when processing specially crafted disk images, reducing availability and requiring manual recovery; the large number of downstream Linux-based packages increases exposure surface.

How an attack unfolds

An attacker constructs a JFS filesystem containing a regular file with a deliberately negative i_size value, then causes a victim system to mount the image and open the file, triggering the unhandled corruption path.

How to fix it

Update the Linux kernel to commit 9f896c3d0192241d6438be6963682ace8203f502 or later; update skopeo and skopeo-oci-compat packages to version 1.19.0-r0 or newer on MinimOS.

How to confirm the fix worked

Verify the running kernel contains commit 9f896c3d0192241d6438be6963682ace8203f502; confirm package versions match the fixed releases; attempt to open a test file with negative i_size on a JFS volume to ensure the check now rejects it.

Typical attack path

1. Build a JFS filesystem image containing a regular file with negative i_size
2. Place the malicious image on a system that will mount it
3. Trigger mount and subsequent open of the corrupted file
4. Observe operation failures or kernel misbehavior

How to detect it

Review kernel logs for JFS open failures or i_size-related warnings on systems that mount untrusted JFS images; correlate with file-system creation timestamps or external image sources.

What your security team should do

• Apply the kernel and package updates immediately on all systems using JFS
• Audit mounted JFS volumes for unexpected file-size anomalies
• Monitor upstream stable kernel releases for additional JFS hardening