Security readout for executives and security teams
Plain-English summary
A flaw in Linux's JFS filesystem code can use an invalid tree index when filesystem metadata is corrupted. Successful triggering could compromise confidentiality, integrity, and availability. The issue requires local access and applies primarily where JFS is enabled or used.
Executive priority
Treat as a high-priority kernel maintenance issue where JFS is used, particularly on multi-user systems or systems handling external storage. Patch through normal emergency or accelerated maintenance. Lower the priority only after confirming JFS is neither enabled nor reachable.
Technical view
CVE-2025-38697 affects dbAllocAG in the Linux JFS implementation. A computed tree index was not checked against the stree upper bound, allowing out-of-bounds behavior when processing corrupted filesystem metadata. The supplied CVSS 3.1 score is 7.8 with local, low-complexity, low-privilege attack conditions and high impacts.
Likely exposure
Prioritize Linux systems that run an affected kernel and mount or process JFS filesystems, especially untrusted or potentially corrupted volumes. Systems without JFS use are less likely to reach the vulnerable path. The supplied version data is complex, so confirm exposure against distribution or vendor advisories.
Exploitation context
The source bundle does not establish active exploitation, and the CVE is not listed as KEV. The CVSS vector indicates local access and low privileges, while the description identifies corrupted filesystem metadata as the triggering condition. Public sources supplied here do not clarify reliable exploitability beyond that condition.
Researcher notes
The defect is an absent upper-bound check for the tree index computed by dbAllocAG relative to stree size. Corrupted metadata can drive the index out of bounds. The supplied material does not identify a CWE, observed exploitation, public proof of concept, or precise consequences demonstrated in practice.
Mitigation direction
- Install a vendor-supported kernel containing the cited JFS bounds-check fix.
- Follow Linux distribution or appliance-vendor advisories for the correct fixed package.
- Restrict mounting or processing of untrusted JFS volumes until patched.
- Reduce JFS use where it is unnecessary and operationally safe to do so.
Validation and detection
- Inventory kernel versions and identify systems where JFS is enabled or mounted.
- Compare installed kernel packages with current distribution or vendor advisories.
- Confirm the deployed kernel includes the applicable cited stable-tree fix.
- Review storage workflows for untrusted or corrupted JFS images and media.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38697 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5bdb9553fb134fd52ec208a8b378120670f6e784CVE reference, Linux
- https://git.kernel.org/stable/c/a4f199203f79ca9cd7355799ccb26800174ff093CVE reference, Linux
- https://git.kernel.org/stable/c/1467a75819e41341cd5ebd16faa2af1ca3c8f4feCVE reference, Linux
- https://git.kernel.org/stable/c/49ea46d9025aa1914b24ea957636cbe4367a7311CVE reference, Linux
- https://git.kernel.org/stable/c/173cfd741ad7073640bfb7e2344c2a0ee005e769CVE reference, Linux
- https://git.kernel.org/stable/c/c8ca21a2836993d7cb816668458e05e598574e55CVE reference, Linux
- https://git.kernel.org/stable/c/2dd05f09cc323018136a7ecdb3d1007be9ede27fCVE reference, Linux
- https://git.kernel.org/stable/c/30e19a884c0b11f33821aacda7e72e914bec26efCVE reference, Linux
- https://git.kernel.org/stable/c/c214006856ff52a8ff17ed8da52d50601d54f9ceCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.