CVE-2025-38230: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38230 Overview

CVE-2025-38230 is a vulnerability in the Linux kernel's Journaled File System (JFS) that stems from missing validation of allocation group (AG) parameters in the dbMount() function. When a maliciously crafted or corrupted JFS filesystem is mounted, the fields db_agheight, db_agwidth, and db_agstart are not validated against expected bounds. This leads to undefined behavior in dbAllocAG(), including shift-out-of-bounds errors detected by UBSAN in fs/jfs/jfs_dmap.c:1400. Local attackers with the ability to mount filesystems or invoke FITRIM ioctls can trigger kernel crashes and potentially compromise integrity and availability. The issue was reported by the Linux Verification Center using Syzkaller.

Critical Impact
A local attacker can trigger kernel-level undefined behavior and crashes by mounting a crafted JFS image and issuing an ioctl, disrupting availability of affected Linux systems.

Affected Products

Linux Kernel (multiple versions from 2.6.12 onward, per NVD CPE data)
Debian Linux 11.0
Systems mounting untrusted JFS filesystem images

Discovery Timeline

2025-07-04 - CVE-2025-38230 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38230

Vulnerability Analysis

The vulnerability resides in the JFS disk block map (dmap) initialization path. The dbMount() function reads on-disk allocation group control (AGC) parameters into the in-memory dbmap structure without validating that they fall within kernel-defined bounds derived from L2LPERCTL, LPERCTL/MAXAG, and CTLTREESIZE. When these parameters are attacker-controlled through a crafted filesystem image, downstream arithmetic in dbAllocAG() performs bit shifts with negative or oversized exponents.

UBSAN captured the resulting shift-out-of-bounds condition with a shift exponent of -335544310, produced along the call path jfs_ioctl → jfs_ioc_trim → dbDiscardAG → dbAllocAG. The behavior is classified as a kernel file system vulnerability [CWE-noinfo] with local attack vector and high impact on confidentiality, integrity, and availability.

Root Cause

The root cause is missing input validation of on-disk metadata. Specifically, dbMount() accepted arbitrary values for db_agheight (should be 0 to L2LPERCTL/2), db_agwidth (should be 1 to min(LPERCTL/MAXAG, 2^(L2LPERCTL - 2*agheight))), and db_agstart (should be 0 to CTLTREESIZE-1 - agwidth*(MAXAG-1)). Without these checks, subsequent computations produced negative shift exponents and out-of-range tree indices.

Attack Vector

Exploitation requires local access with the privilege to mount a filesystem or invoke ioctls such as FITRIM on a JFS mount. An attacker crafts a JFS image containing corrupted AGC parameters, mounts the image, and issues an ioctl that traverses dbDiscardAG() and dbAllocAG(). The kernel then executes an out-of-bounds shift operation, producing undefined behavior and, in typical configurations, a kernel crash.

No verified public exploit or proof-of-concept has been published. The syzkaller report from the Linux Verification Center provides the reproducer context. See the Linux kernel commit series for the code-level fix.

Detection Methods for CVE-2025-38230

Indicators of Compromise

Kernel logs containing UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c entries
Unexpected kernel panics or oops traces referencing dbAllocAG, dbDiscardAG, or jfs_ioc_trim
Mount events for JFS filesystems originating from untrusted images, USB devices, or loopback files

Detection Strategies

Monitor dmesg and /var/log/kern.log for UBSAN reports referencing jfs_dmap.c line 1400 or nearby offsets
Audit mount syscalls with filesystem type jfs using auditd rules targeting -S mount -F key=jfs_mount
Correlate ioctl invocations of FITRIM on JFS mounts with subsequent kernel crash telemetry

Monitoring Recommendations

Forward kernel ring buffer and audit logs to a centralized SIEM for correlation across hosts
Alert on any JFS mount from removable media in server environments where JFS is not expected
Track kernel version inventory to identify hosts running unpatched builds prior to the fixed commits

How to Mitigate CVE-2025-38230

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits c3705c82b740, 95ae5ee6069d, a4259e72363e, and related stable backports
Update Debian 11 systems using the Debian LTS Announcement and the second Debian LTS Announcement
Restrict mount privileges by ensuring only trusted administrators can mount block devices or loopback images

Patch Information

The Linux kernel maintainers resolved the issue by adding explicit bounds checks for db_agheight, db_agwidth, and db_agstart inside dbMount(). Corrupted metadata is now rejected at mount time before it can influence dbAllocAG(). Fixed commits are published at kernel.org stable tree with backports available for maintained stable branches.

Workarounds

Disable the JFS kernel module where not required using echo "blacklist jfs" > /etc/modprobe.d/blacklist-jfs.conf
Prevent unprivileged users from mounting filesystems by removing user and users options from /etc/fstab and disabling udisks auto-mount for removable media
Enforce noexec, nosuid, and nodev on any mount point that must accept untrusted media

bash

# Configuration example
# Disable the JFS module on systems that do not require it
echo "blacklist jfs" | sudo tee /etc/modprobe.d/blacklist-jfs.conf
sudo rmmod jfs 2>/dev/null || true

# Verify current kernel version against fixed builds
uname -r

# On Debian, apply security updates
sudo apt update && sudo apt upgrade linux-image-$(uname -r | sed 's/.*-//')