7.8

CVE-2025-38230: jfs: validate AG parameters in dbMount() to prevent crashes

Modified
AliasesUBUNTU-CVE-2025-38230DEBIAN-CVE-2025-38230
Published 04-07-2025Last modified 05-08-2026

Vulnerability summary

CVE-2025-38230 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.19%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 17
DLA-4327-1DLA-4328-1DSA-5973-1USN-7856-1USN-8028-1USN-8028-2

Timeline

  1. 04-07-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount() to prevent crashes Validate db_agheight, db_agwidth, and db_agstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL, LPERCTL/MAXAG, and CTLTREESIZE: - agheight: 0 to L2LPERCTL/2 (0 to 5) ensures shift (L2LPERCTL - 2*agheight) >= 0. - agwidth: 1 to min(LPERCTL/MAXAG, 2^(L2LPERCTL - 2*agheight)) ensures agperlev >= 1. - Ranges: 1-8 (agheight 0-3), 1-4 (agheight 4), 1 (agheight 5). - LPERCTL/MAXAG = 1024/128 = 8 limits leaves per AG; 2^(10 - 2*agheight) prevents division to 0. - agstart: 0 to CTLTREESIZE-1 - agwidth*(MAXAG-1) keeps ti within stree (size 1365). - Ranges: 0-1237 (agwidth 1), 0-348 (agwidth 8). UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:1400:9 shift exponent -335544310 is negative CPU: 0 UID: 0 PID: 5822 Comm: syz-executor130 Not tainted 6.14.0-rc5-syzkaller #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 dbAllocAG+0x1087/0x10b0 fs/jfs/jfs_dmap.c:1400 dbDiscardAG+0x352/0xa20 fs/jfs/jfs_dmap.c:1613 jfs_ioc_trim+0x45a/0x6b0 fs/jfs/jfs_discard.c:105 jfs_ioctl+0x2cd/0x3e0 fs/jfs/ioctl.c:131 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.19%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.18% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu146 products
  • linuxAll versions (No fix recorded) | < 5.15.0-156.166 | < 6.8.0-100.100
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1092.99 | < 6.8.0-1046.49
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 95ae5ee6069d9a5945772625f289422ef659221a | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a4259e72363e1ea204a97292001a9fc36c7e52fd | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < c3705c82b7406a15ef38a610d03bf6baa43d6e0c | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9242ff6245527a3ebb693ddd175493b38ddca72f | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 0c40fa81f850556e9aa0185fede9ef1112db7b39 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8b69608c6b6779a7ab07ce4467a56df90152cfb9 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b62a1e59d8716bbd2e73660743fe06acc97ed7d1 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 37bfb464ddca87f203071b5bd562cd91ddc0b40a | 2.6.12
  • linux_kernel≥ 2.6.13, < 5.4.296 | ≥ 5.5, < 5.10.240 | ≥ 5.11, < 5.15.187 | ≥ 5.16, < 6.1.143 | ≥ 6.2, < 6.6.96 | ≥ 6.7, < 6.12.36 | ≥ 6.13, < 6.15.4 | 2.6.12 | 2.6.12:rc2 | 2.6.12:rc3 | 2.6.12:rc4 | 2.6.12:rc5

3 vendors · 150 products

References

31 links
Show all 31 references