Security readout for executives and security teams
Plain-English summary
A flaw in the Linux JFS filesystem can make the kernel read beyond an array while listing a directory. Triggering it requires local interaction with affected JFS data; it is not described as remotely exploitable. The supplied CVSS assessment is 7.8 and indicates potentially serious confidentiality, integrity, and availability consequences, although the sources do not detail specific outcomes.
Executive priority
Prioritize affected systems that actively use JFS or handle externally supplied filesystem data. Remediate through normal high-severity kernel patching, accelerating exposed or high-value hosts. Broad emergency action is not supported by the supplied evidence because active exploitation is not reported and triggering is characterized as local with user interaction.
Technical view
In JFS add_missing_indices, an s8 value stores offsets into a slot array whose valid offsets can reach 127. Invalid signed values can cause an out-of-bounds read. The correction validates the offset, returns -EIO on failure, and makes jfs_readdir propagate that error. The bundle identifies stable-kernel correction commits but provides ambiguous affected-version formatting.
Likely exposure
Exposure is most likely where an affected Linux kernel has JFS available and processes a triggering JFS directory state. Systems that do not use or permit JFS have substantially reduced practical exposure. Confirm distribution-specific status because the supplied version list does not clearly express fixed-versus-vulnerable ranges.
Exploitation context
The CVSS vector characterizes exploitation as local, low complexity, requiring no privileges but requiring user interaction. The bundle marks KEV false and provides no evidence of active exploitation, public weaponization, or remote reachability. Treat claims beyond those facts as unconfirmed.
Researcher notes
The root issue is an out-of-bounds read caused by representing slot offsets with signed 8-bit storage. The patch adds bounds validation and error propagation through jfs_readdir. The supplied CVSS claims high impact across all three security properties, but the bundle does not document a demonstrated crash, disclosure, corruption primitive, or code-execution path.
Mitigation direction
- Install a supported vendor kernel update that incorporates the cited JFS correction.
- Consult the Linux distribution's advisory for package-specific fixed versions.
- Avoid processing untrusted JFS filesystems until the corrected kernel is running.
- Reboot into the updated kernel when required by the distribution.
Validation and detection
- Inventory running kernel versions and associated distribution package builds.
- Determine whether JFS is enabled, mounted, or operationally required.
- Match vendor changelogs against CVE-2025-38204 or the cited stable commits.
- After updating, confirm every system is running the corrected kernel.
- Reassess JFS usage and document systems awaiting remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38204 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/81af4b34fd72d390d7f237c6a545cc6d09707956CVE reference, Linux
- https://git.kernel.org/stable/c/bfa4655d28f338e68d345aed80d19be7999bbce2CVE reference, Linux
- https://git.kernel.org/stable/c/44618bee303bed151ef3a525ff79fbd7689593b5CVE reference, Linux
- https://git.kernel.org/stable/c/c8399564a58fb6ea2ff21a6fd278417943cb51a5CVE reference, Linux
- https://git.kernel.org/stable/c/5dff41a86377563f7a2b968aae00d25b4ceb37c9CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.