CVE-2025-38204: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38204 Overview

CVE-2025-38204 is an out-of-bounds read vulnerability in the Journaled File System (JFS) implementation of the Linux kernel. The flaw resides in the add_missing_indices function, where the stbl variable is declared as s8 but must contain offsets into a slot array ranging from 0 to 127. Without a proper bounds check, the function can read memory outside the intended array, leading to memory corruption or kernel crash conditions. The vulnerability affects the Linux kernel and Debian Linux 11.0, and is tracked under [CWE-125] (Out-of-Bounds Read).

Critical Impact
A local attacker with low privileges can trigger the flaw by mounting or reading a crafted JFS filesystem, causing kernel information disclosure or denial of service.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Debian Linux 11.0
Systems using JFS (Journaled File System) module

Discovery Timeline

2025-07-04 - CVE-2025-38204 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38204

Vulnerability Analysis

The vulnerability exists in the JFS directory handling code within the Linux kernel. Specifically, the add_missing_indices function processes directory slot table entries during directory operations. The stbl variable, typed as s8 (signed 8-bit integer), stores offsets into a slot array that legitimately spans indices 0 through 127.

When JFS parses a corrupted or maliciously crafted directory structure, stbl values can point outside the valid slot range. The absence of a bounds check allows the kernel to dereference memory beyond the intended buffer, resulting in an out-of-bounds read [CWE-125]. The fix adds a bounds check that returns -EIO when the check fails, and propagates the error from add_missing_indices back through jfs_readdir.

Root Cause

The root cause is missing input validation on filesystem metadata. The JFS on-disk structure is treated as trusted, but attacker-controlled directory entries can carry arbitrary offset values. Without validating that stbl entries fall within the slot array bounds, add_missing_indices reads beyond allocated memory. The condition is triggered when directory index entries are missing and the recovery path walks the slot table.

Attack Vector

Exploitation requires local access with low privileges. An attacker must be able to mount a crafted JFS image or influence directory contents on an existing JFS volume. Systems that auto-mount removable media containing JFS filesystems are particularly exposed. Successful exploitation can leak kernel memory contents to the attacker or crash the kernel, resulting in denial of service. The vulnerability does not require user interaction beyond directory enumeration operations such as readdir.

Because no verified proof-of-concept code is publicly available, refer to the upstream commits linked below for the precise code path and patch semantics.

Detection Methods for CVE-2025-38204

Indicators of Compromise

Kernel log entries reporting -EIO errors from jfs_readdir or add_missing_indices on JFS volumes.
KASAN (Kernel Address Sanitizer) reports of array-index-out-of-bounds in JFS directory functions.
Unexpected kernel panics or oops messages referencing JFS while enumerating directories.
Mount events for JFS filesystems originating from removable or user-writable media.

Detection Strategies

Audit running kernel versions across Linux fleets and compare against the fixed commits 44618bee, 5dff41a8, 81af4b34, bfa4655d, and c8399564.
Monitor for the presence and use of the jfs kernel module on systems where it is not required.
Correlate mount syscalls of JFS filesystems with subsequent kernel errors in dmesg or /var/log/kern.log.

Monitoring Recommendations

Enable auditd rules on mount syscalls filtered by filesystem type jfs.
Ship kernel logs to a centralized SIEM and alert on add_missing_indices, jfs_readdir, or KASAN traces.
Track privileged user activity on hosts that expose JFS mount capabilities, including USB automount daemons.

How to Mitigate CVE-2025-38204

Immediate Actions Required

Apply the vendor-supplied kernel updates for affected distributions, including the Debian LTS advisory referenced in the Debian LTS Announcement.
Reboot into the patched kernel to ensure the vulnerable module is unloaded.
Restrict mounting of untrusted filesystem images to privileged administrators only.

Patch Information

Upstream fixes are available in the mainline and stable trees via the following commits: Kernel Commit 44618bee, Kernel Commit 5dff41a86, Kernel Commit 81af4b34f, Kernel Commit bfa4655d2, and Kernel Commit c8399564a. The patch adds a bounds check on stbl values and returns -EIO when the check fails, and ensures jfs_readdir propagates errors from add_missing_indices.

Workarounds

Blacklist the jfs kernel module on systems that do not require JFS support by adding blacklist jfs to /etc/modprobe.d/.
Disable automatic mounting of removable media in desktop and server configurations.
Restrict CAP_SYS_ADMIN and mount privileges to trusted administrators using namespaces or MAC policies such as AppArmor or SELinux.

bash

# Configuration example
# Blacklist the JFS module on hosts that do not require it
echo "blacklist jfs" | sudo tee /etc/modprobe.d/blacklist-jfs.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep jfs