CVE-2025-38230

Q: What is the severity of CVE-2025-38230?

CVE-2025-38230 has a CVSS score of 7.8 (HIGH). A vulnerability in the Linux kernel's JFS filesystem allows attackers to trigger a shift-out-of-bounds error by providing corrupted metadata, leading to kernel crashes. This affects systems using JFS filesystems and can be exploited by local users with filesystem access. The vulnerability was discovered through fuzzing and requires specific conditions to trigger.

7.8 HIGH

Denial of Service

📋 TL;DR

A vulnerability in the Linux kernel's JFS filesystem allows attackers to trigger a shift-out-of-bounds error by providing corrupted metadata, leading to kernel crashes. This affects systems using JFS filesystems and can be exploited by local users with filesystem access. The vulnerability was discovered through fuzzing and requires specific conditions to trigger.

💻 Affected Systems

Products:

Linux kernel with JFS filesystem support

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with JFS support enabled

Default Config Vulnerable: ✅ No

Notes: Only affects systems using JFS filesystems. Many distributions don't enable JFS by default or use it as primary filesystem.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially causing data corruption or loss if the crash occurs during critical filesystem operations.

🟠

Likely Case

Local denial of service through kernel crash when processing specially crafted JFS metadata, requiring filesystem access to exploit.

🟢

If Mitigated

Minimal impact if systems don't use JFS filesystems or have proper access controls limiting filesystem manipulation.

🌐 Internet-Facing: LOW - Requires local filesystem access, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users with filesystem access could crash the kernel, but requires specific JFS usage and metadata corruption.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to corrupt JFS metadata. Found through syzkaller fuzzing, not known to be actively exploited.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 0c40fa81f850556e9aa0185fede9ef1112db7b39, 37bfb464ddca87f203071b5bd562cd91ddc0b40a, 8b69608c6b6779a7ab07ce4467a56df90152cfb9, 9242ff6245527a3ebb693ddd175493b38ddca72f, 95ae5ee6069d9a5945772625f289422ef659221a

Vendor Advisory: https://git.kernel.org/stable/c/0c40fa81f850556e9aa0185fede9ef1112db7b39

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable JFS filesystem

linux

Remove JFS kernel module to prevent use of vulnerable filesystem

sudo rmmod jfs
echo 'blacklist jfs' | sudo tee /etc/modprobe.d/blacklist-jfs.conf

Restrict filesystem access

linux

Limit user access to JFS filesystems to prevent metadata manipulation

sudo chmod 700 /mountpoint
sudo chown root:root /mountpoint

🧯 If You Can't Patch

Avoid using JFS filesystems for critical systems
Implement strict access controls to limit who can mount or modify JFS filesystems

🔍 How to Verify

Check if Vulnerable:

Check if JFS filesystems are mounted: 'mount | grep -i jfs' or 'cat /proc/filesystems | grep jfs'

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commits: 'uname -r' and verify with distribution security advisory

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
UBSAN shift-out-of-bounds errors in kernel logs
System crash/reboot events

Network Indicators:

None - local vulnerability

SIEM Query:

source="kernel" AND ("shift-out-of-bounds" OR "UBSAN" OR "jfs_dmap" OR "dbAllocAG")

📊 Metadata

CVE ID: CVE-2025-38230

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score: 0.02% exploit probability (3.6th percentile)

Published: July 4, 2025

Last Updated: December 18, 2025

🔗 References

https://git.kernel.org/stable/c/0c40fa81f850556e9aa0185fede9ef1112db7b39 Patch
https://git.kernel.org/stable/c/37bfb464ddca87f203071b5bd562cd91ddc0b40a Patch
https://git.kernel.org/stable/c/8b69608c6b6779a7ab07ce4467a56df90152cfb9 Patch
https://git.kernel.org/stable/c/9242ff6245527a3ebb693ddd175493b38ddca72f Patch
https://git.kernel.org/stable/c/95ae5ee6069d9a5945772625f289422ef659221a Patch
https://git.kernel.org/stable/c/a4259e72363e1ea204a97292001a9fc36c7e52fd Patch
https://git.kernel.org/stable/c/b62a1e59d8716bbd2e73660743fe06acc97ed7d1 Patch
https://git.kernel.org/stable/c/c3705c82b7406a15ef38a610d03bf6baa43d6e0c Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory,Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory,Mailing List

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable JFS filesystem

Restrict filesystem access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export