Security readout for executives and security teams
Plain-English summary
A flaw in the Linux JFS filesystem can turn corrupted inode metadata into a kernel locking deadlock. A local, low-privileged user may be able to trigger the affected path, potentially disrupting the host. The evidence supplied demonstrates a deadlock, not remote compromise, and does not establish active exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue for JFS systems, especially multi-user hosts or systems supporting loop-device workflows. Inventory and patch promptly. Local access requirements and the absence of confirmed active exploitation make this less urgent than an internet-facing remote vulnerability.
Technical view
Corrupted JFS aggregate inode table metadata can produce an on-disk inode with nlink set to zero. copy_from_dinode propagates it into an IAG inode, after which allocation and cleanup recursively acquire the same lock and deadlock in diFree. The fix validates nlink before populating the special inode. The supplied CVSS score is 7.8.
Likely exposure
Exposure is concentrated on affected Linux systems that use JFS and allow local users to reach relevant filesystem or loop-device operations. Systems not using JFS are less likely to reach this path. Because the supplied version data lacks clear range semantics, confirm exposure through distribution advisories and backport information.
Exploitation context
The source describes a syzbot-triggered deadlock under crafted local filesystem and loop-device conditions. The CVE is not listed as KEV in the supplied bundle, and no cited source establishes exploitation in the wild. The evidence does not support treating this as a remotely exploitable issue.
Researcher notes
The affected-version data repeats one commit identifier and lists upstream versions without explicit range relationships, limiting precise exposure conclusions. Use vendor package advisories and stable-commit ancestry. The demonstrated result is a recursive-locking deadlock caused by corrupted metadata; the bundle does not provide evidence demonstrating the broader confidentiality and integrity impacts represented in the CVSS vector.
Mitigation direction
- Apply a distribution-supported kernel update incorporating the appropriate cited Linux stable fix.
- Reboot into the updated kernel so the remediated build is actually running.
- If patching is delayed, consult vendor guidance; the supplied sources identify no supported temporary workaround.
Validation and detection
- Record each host's running kernel version and distribution package release.
- Determine whether JFS is enabled, mounted, or used in loop-device workflows.
- Map vendor package status to CVE-2025-37741 and confirm any backported fix.
- After rebooting, verify the running kernel matches the remediated vendor build.
- Review kernel logs for JFS deadlock or recursive-locking warnings; their absence does not prove safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37741 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5b2f26d3fba4e9aac314f8bc0963b3fc28c0e456CVE reference, Linux
- https://git.kernel.org/stable/c/8b5ce75f8bd3ddf480cc0a240d7ff5cdea0444f9CVE reference, Linux
- https://git.kernel.org/stable/c/86bfeaa18f9e4615b97f2d613e0fcc4ced196527CVE reference, Linux
- https://git.kernel.org/stable/c/c9541c2bd0edbdbc5c1148a84d3b48dc8d1b8af2CVE reference, Linux
- https://git.kernel.org/stable/c/b3c4884b987e5d8d0ec061a4d52653c4f4b9c37eCVE reference, Linux
- https://git.kernel.org/stable/c/aeb926e605f97857504bdf748f575e40617e2ef9CVE reference, Linux
- https://git.kernel.org/stable/c/994787341358816d91b2fded288ecb7f129f2b27CVE reference, Linux
- https://git.kernel.org/stable/c/a2b560815528ae8e266fca6038bb5585d13aaef4CVE reference, Linux
- https://git.kernel.org/stable/c/b61e69bb1c049cf507e3c654fa3dc1568231bd07CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.