Security readout for executives and security teams
Plain-English summary
A corrupted JFS filesystem can feed invalid allocation-group metadata into the Linux kernel. Later filesystem operations may then cause undefined behavior and crash the system. The clearest demonstrated business risk is disruption to Linux hosts that mount affected JFS volumes; the supplied evidence does not establish remote exploitation or data compromise.
Executive priority
Treat this as a high-priority stability issue for systems using JFS, especially where filesystem content crosses trust boundaries. Patch those systems promptly through supported distribution channels. General Linux fleets without JFS exposure can follow normal kernel maintenance after confirming the filesystem is unused.
Technical view
JFS dbMount() failed to validate db_agheight, db_agwidth, and db_agstart. Invalid values could produce a negative shift or zero-derived allocation geometry in dbAllocAG, as demonstrated under UBSAN during a trim operation. The fix constrains these fields using JFS control-tree limits and rejects corrupted metadata earlier.
Likely exposure
Exposure is concentrated on affected Linux kernels where JFS is enabled and a corrupted or attacker-influenced JFS filesystem is mounted or processed. Risk is higher for removable-media workflows, disk-image analysis, recovery systems, and multi-tenant services accepting filesystem images. Hosts that never use JFS are unlikely to reach the vulnerable path.
Exploitation context
The CVSS vector describes a local, low-complexity issue requiring user interaction and no prior privileges. The source bundle reports no KEV listing, and no cited source claims exploitation in the wild. Syzkaller demonstrated a kernel undefined-behavior crash; broader confidentiality or integrity impact is not demonstrated here.
Researcher notes
The supplied crash shows a negative shift in dbAllocAG reached through jfs_ioc_trim after corrupted metadata passed dbMount(). Validation bounds depend on L2LPERCTL, LPERCTL/MAXAG, CTLTREESIZE, and MAXAG. The affected-version data is not sufficiently clear for independent branch-by-branch conclusions; consult the referenced commits and distribution advisories.
Mitigation direction
- Install a vendor-supported kernel update containing the CVE-2025-38230 JFS fix.
- Prioritize systems that mount JFS volumes or process filesystem images from less-trusted sources.
- Restrict mounting or processing untrusted JFS filesystems until affected systems are updated.
- Follow Linux distribution advisories for package-specific fixed versions and reboot requirements.
Validation and detection
- Inventory running kernel versions and compare them with applicable vendor advisories or referenced stable fixes.
- Identify active JFS mounts and workflows that accept removable media or externally supplied filesystem images.
- Review kernel logs for JFS faults, UBSAN shift errors, crashes, or failures associated with trim operations.
- Verify updated kernels reject invalid allocation-group metadata without reaching JFS allocation or trim logic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38230 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/95ae5ee6069d9a5945772625f289422ef659221aCVE reference, Linux
- https://git.kernel.org/stable/c/a4259e72363e1ea204a97292001a9fc36c7e52fdCVE reference, Linux
- https://git.kernel.org/stable/c/c3705c82b7406a15ef38a610d03bf6baa43d6e0cCVE reference, Linux
- https://git.kernel.org/stable/c/9242ff6245527a3ebb693ddd175493b38ddca72fCVE reference, Linux
- https://git.kernel.org/stable/c/0c40fa81f850556e9aa0185fede9ef1112db7b39CVE reference, Linux
- https://git.kernel.org/stable/c/8b69608c6b6779a7ab07ce4467a56df90152cfb9CVE reference, Linux
- https://git.kernel.org/stable/c/b62a1e59d8716bbd2e73660743fe06acc97ed7d1CVE reference, Linux
- https://git.kernel.org/stable/c/37bfb464ddca87f203071b5bd562cd91ddc0b40aCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.