Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
CVE Vulnerability Database
Vulnerability Database/CVE-2025-39743

CVE-2025-39743: Linux Kernel Privilege Escalation Flaw

CVE-2025-39743 is a privilege escalation vulnerability in the Linux Kernel JFS filesystem that triggers when inodes with zero hard links fail to truncate pages. This article covers technical details, affected versions, and mitigations.

Published:

CVE-2025-39743 Overview

CVE-2025-39743 is a Linux kernel vulnerability in the Journaled File System (JFS) that triggers a BUG_ON condition during inode eviction. When the kernel processes a crafted JFS image with an inode whose fileset value equals AGGR_RESERVED_I and a hard link count of zero, its inode pages are not truncated. The subsequent call to clear_inode() fails because nrpages is greater than zero, causing a kernel panic. A local attacker with the ability to mount a malicious JFS image can leverage this to compromise system availability and integrity.

Critical Impact

Local attackers can trigger a kernel BUG_ON in the JFS eviction path, resulting in denial of service and potential impact to confidentiality, integrity, and availability.

Affected Products

  • Linux kernel (multiple stable branches prior to the fix commits)
  • Debian Linux 11.0 (patched via Debian LTS)
  • Siemens products bundling the affected kernel per Siemens Security Advisory SSA-032379

Discovery Timeline

Technical Details for CVE-2025-39743

Vulnerability Analysis

The flaw resides in the JFS eviction routine within the Linux kernel filesystem code. JFS inodes carry a fileset field that identifies their aggregate. When a reproducer supplies a disk image containing an inode whose fileset equals the reserved value AGGR_RESERVED_I, the eviction logic treats the inode as a reserved aggregate inode and skips page truncation despite the hard link count (i_nlink) being zero.

Skipping truncation leaves cached pages attached to the inode's address space. The kernel then calls clear_inode(), which asserts that mapping->nrpages == 0. The assertion fails and triggers a BUG_ON, panicking the kernel. This is a kernel filesystem bug arising from missing state validation before an invariant check.

Root Cause

The eviction path did not truncate inode pages when the hard link count reached zero on inodes marked with the reserved fileset identifier. The mismatch between the fileset-driven code path and the nrpages invariant enforced by clear_inode() produces an unrecoverable assertion.

Attack Vector

Exploitation requires local access with the ability to mount or otherwise expose a crafted JFS filesystem image to the kernel. The attack complexity is low and no user interaction is required, though low-level privileges are needed to initiate the mount. Successful exploitation crashes the kernel and can be repeated to sustain denial of service.

Refer to the upstream fix commits, including Kernel Commit 1bb5cdc and Kernel Commit df3fd8d, for the code-level correction that ensures inode pages are truncated when i_nlink is zero.

Detection Methods for CVE-2025-39743

Indicators of Compromise

  • Kernel oops or panic entries in dmesg referencing clear_inode, evict, or JFS functions such as jfs_evict_inode
  • Unexpected mounts of JFS filesystems from removable media, loopback images, or user-writable paths
  • Repeated system crashes correlated with the same non-privileged user session

Detection Strategies

  • Monitor mount syscalls that specify -t jfs on hosts where JFS is not part of the expected workload
  • Alert on kernel ring buffer entries matching BUG: or kernel BUG at fs/jfs/ patterns
  • Correlate filesystem image staging (file creation followed by losetup or mount) with subsequent kernel faults

Monitoring Recommendations

  • Forward /var/log/kern.log and journalctl -k output to a centralized logging platform for kernel-panic pattern matching
  • Track loaded kernel modules and flag on-demand loading of the jfs module on systems that do not require it
  • Baseline mount activity by user and image source so anomalous JFS mounts stand out

How to Mitigate CVE-2025-39743

Immediate Actions Required

  • Apply the latest stable kernel updates from your distribution vendor that include the JFS eviction fix
  • Debian 11 users should install the packages referenced in the Debian LTS announcements for October 2025
  • Restrict who can mount filesystems by removing SYS_ADMIN capability from unprivileged workloads and disabling automount for removable media

Patch Information

The fix is available in upstream stable kernel commits, including Kernel Commit 1bb5cdc, Kernel Commit 2b1d5ca, Kernel Commit 2d91b37, Kernel Commit 34d8e98, Kernel Commit 5845b92, Kernel Commit 89fff8e, Kernel Commit 8ed7275, Kernel Commit b5b4718, and Kernel Commit df3fd8d. Siemens customers should consult Siemens Security Advisory SSA-032379 for product-specific guidance.

Workarounds

  • Blacklist the jfs kernel module on systems that do not require JFS support
  • Disable automatic mounting of untrusted or removable media in desktop environments and udev rules
  • Apply Linux Security Module policies (SELinux or AppArmor) that prevent unprivileged users from invoking mount on arbitrary block devices

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne