CVE-2025-37740 – A divide-by-zero vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2025-37740?

CVE-2025-37740 has a CVSS score of 5.5 (MEDIUM). A divide-by-zero vulnerability in the Linux kernel's JFS filesystem can cause kernel panic when mounting filesystems with malformed allocation group metadata. This affects systems using JFS filesystem with vulnerable kernel versions, potentially leading to denial of service.

📋 TL;DR

A divide-by-zero vulnerability in the Linux kernel's JFS filesystem can cause kernel panic when mounting filesystems with malformed allocation group metadata. This affects systems using JFS filesystem with vulnerable kernel versions, potentially leading to denial of service.

💻 Affected Systems

Products:

Linux kernel with JFS filesystem support

Versions: Specific kernel versions containing the vulnerable code (check git commits for exact ranges)

Operating Systems: Linux distributions with JFS support enabled

Default Config Vulnerable: ✅ No

Notes: Only affects systems using JFS filesystem. Many distributions don't enable JFS by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, requiring physical or remote console access to reboot

🟠

Likely Case

System crash when mounting or accessing corrupted JFS filesystems, causing temporary service disruption

🟢

If Mitigated

No impact if patch is applied or JFS filesystem is not used

🌐 Internet-Facing: LOW - Requires local filesystem access or ability to mount JFS filesystems

🏢 Internal Only: MEDIUM - Could be exploited by local users or through filesystem corruption to cause denial of service

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to create or corrupt JFS filesystem metadata. Likely requires local access or filesystem manipulation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 722e72f7f9c69fcb3ab7988c2471feff7a4c8de1, a065cec230aa807c18828a3eee82f1c8592c2adf, a260bf14cd347878f01f70739ba829442a474a16, a741f29ac8b6374c9904be8b7ac7cdfcd7e7e4fa, c8c96a9e7660e5e5eea445978fe8f2e432d91c1f

Vendor Advisory: https://git.kernel.org/stable/c/722e72f7f9c69fcb3ab7988c2471feff7a4c8de1

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable JFS filesystem support

linux

Remove JFS kernel module to prevent filesystem mounting

modprobe -r jfs
echo 'blacklist jfs' >> /etc/modprobe.d/blacklist.conf

Avoid JFS filesystem usage

linux

Use alternative filesystems and avoid mounting JFS partitions

# Do not mount JFS filesystems
# Use ext4, xfs, or btrfs instead

🧯 If You Can't Patch

Restrict local user access to prevent filesystem manipulation
Implement strict filesystem integrity monitoring and backup procedures

🔍 How to Verify

Check if Vulnerable:

Check if JFS module is loaded: lsmod | grep jfs. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update and ensure JFS module loads without issues

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
Divide error or arithmetic exception in kernel logs
JFS mount failures

Network Indicators:

None - local filesystem vulnerability

SIEM Query:

source="kernel" AND ("divide error" OR "divide by zero" OR "kernel panic") AND "jfs"

📊 Metadata

CVE ID: CVE-2025-37740

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-369

EPSS Score: 0.02% exploit probability (4.2th percentile)

Published: May 1, 2025

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-37740, you might also want to check these: