CVE-2025-39743

What it actually does

Failure to truncate inode pages for JFS inodes with hard link count of zero (when fileset is AGGR_RESERVED_I) leaves nrpages > 0, triggering BUG_ON during clear_inode and resulting in memory corruption or kernel panic.

Why it matters to the business

Linux systems using the JFS filesystem may experience unexpected crashes or denial of service during normal file operations or inode eviction, requiring reboots and potential data recovery; high prevalence of Linux kernels increases operational risk.

How an attack unfolds

An attacker with local access creates or manipulates a JFS inode via a reproducer that sets fileset to AGGR_RESERVED_I and hard link count to zero; during evict and subsequent clear_inode the untruncated pages cause the kernel assertion failure, potentially allowing local privilege escalation or denial of service.

How to fix it

Update the Linux kernel to the fixed commit 89fff8e3d6710fc32507b8e19eb5afa9fb79b896 or later stable release containing the JFS truncate fix; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify kernel source contains commit 89fff8e3d6710fc32507b8e19eb5afa9fb79b896; attempt to reproduce the original inode eviction scenario and confirm no BUG_ON occurs; inspect dmesg and kernel logs for JFS-related warnings.

Typical attack path

1. Obtain local user access on a Linux system with JFS filesystem
2. Trigger inode creation or copy with AGGR_RESERVED_I fileset value and hard link count of zero
3. Force inode eviction to skip page truncation
4. Invoke clear_inode which hits BUG_ON due to nrpages > 0

How to detect it

Search kernel logs and dmesg for JFS BUG_ON messages referencing clear_inode or nrpages; look for inode eviction events involving AGGR_RESERVED_I fileset values; review audit logs for unusual JFS file operations preceding crashes.

• BUG_ON.*clear_inode.*nrpages
• jfs.*evict.*hardlink.*0
• AGGR_RESERVED_I

What your security team should do

• Prioritize patching production kernels using JFS within the next maintenance window
• Monitor for JFS inode eviction events in system logs
• Restrict untrusted local access until patches are applied
• Test the fix in a staging environment with JFS workloads before broad deployment