PT-2025-27969 · Linux+6 · Linux Kernel+6
Published
2025-07-04
·
Updated
2026-04-20
·
CVE-2025-38194
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.1.128
Description:
A bug in the jffs2 file system has been detected, caused by a fault injection in jffs2 prealloc raw node refs. The function jffs2 sum write sumnode does not check the return value of jffs2 prealloc raw node refs, allowing any error to propagate into jffs2 sum write data, which eventually calls jffs2 link node ref. This can lead to a kernel bug. The issue was found by the Linux Verification Center with Syzkaller.
Recommendations:
To resolve this issue, check the return value of
jffs2 prealloc raw node refs before calling jffs2 sum write data.
As a temporary workaround, consider disabling the jffs2 link node ref function until a patch is available.
Restrict access to the vulnerable jffs2 module to minimize the risk of exploitation.Exploit
Fix
Unchecked Return Value
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu