CVE-2025-39842: debian debian_linux
Vulnerability summary
CVE-2025-39842 is a medium (CVSS 5.5) vulnerability in debian debian_linux. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 28 · Related 25Timeline
- 19-09-2025PublishedVulnerability first disclosed.
- 12-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode(). ocfs2_dismount_volume()-> ocfs2_delete_osb()-> ocfs2_free_slot_info()-> __ocfs2_free_slot_info()-> evict()-> ocfs2_evict_inode()-> ocfs2_clear_inode()-> jbd2_journal_release_jbd_inode(osb->journal->j_journal, Adding osb->journal checks will prevent null-ptr-deref during the above execution path.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
0.00 pp
From 0.17% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu122 products
- linux< 6.8.0-106.106
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1050.53
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.153-1 | < 6.12.48-1 | < 6.16.6-1
- debian_linuxEOL11.0
Linux2 products
- linux≥ da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < 42c415c53ad2065088cc411d08925effa5b3d255 | ≥ da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < e9188f66e94955431ddbe2cd1cdf8ff2bb486abf | ≥ da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < f4a917e6cd6c798f7adf39907f117fc754db1283 | ≥ da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < 85e66331b60601d903cceaf8c10a234db863cd78 | ≥ da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < f46e8ef8bb7b452584f2e75337b619ac51a7cadf | 5.16
- linux_kernel≥ 5.16, < 6.1.151 | ≥ 6.2, < 6.6.105 | ≥ 6.7, < 6.12.46 | ≥ 6.13, < 6.16.6 | 6.17:rc1 | 6.17:rc2 | 6.17:rc3 | 6.17:rc4
3 vendors · 126 products
