{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38697","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T04:51:24.032Z","datePublished":"2025-09-04T15:32:49.848Z","dateUpdated":"2026-08-05T12:04:00.074Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:04:00.074Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\njfs: upper bound check of tree index in dbAllocAG\n\nWhen computing the tree index in dbAllocAG, we never check if we are\nout of bounds realative to the size of the stree.\nThis could happen in a scenario where the filesystem metadata are\ncorrupted."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached only by mounting a crafted JFS image and then performing ordinary block-allocating file operations on the local mount; no network or adjacent-network peer supplies the corrupted bmap descriptor.\nAC:L - The attacker authors `dn_agstart`, `dn_agwidth`, `dn_agheight`, `dn_numag` and the dmapctl `stree` bytes directly in the image, so the out-of-bounds index and the descent depth are chosen deterministically and trigger on the first allocation — no race, memory-layout luck, or timing condition is involved.\nPR:L - An unprivileged local user is enough in the common deployment where removable media or user-supplied images are auto-mounted (udisks2/autofs on desktops, kiosks, shared workstations), matching how the other crafted-image JFS/HFS/F2FS issues in this series are treated.\nUI:N - Once the image is mounted, the attacker alone drives the trigger by creating or writing a file (or issuing FITRIM); no victim action is required at any point in the exploit.\nS:U - The out-of-bounds accesses and the resulting corruption stay within kernel memory and the kernel's own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked index grows geometrically through the descent (1237 → ~1,267,029), reading kernel memory up to ~1.2 MB past a 4 KB page-cache page, and the bytes read select the returned block number that JFS records in the file's extent map — recoverable via FIEMAP/FIBMAP as a repeatable kernel-memory disclosure oracle.\nI:H - The attacker-steered index propagates into `blkno` and on into `dbAllocCtl()`/`dbAllocDmap()`/`dbAdjCtl()`, so out-of-bounds kernel data is written into allocation bitmaps, dmapctl trees, and file extents at attacker-influenced offsets, corrupting filesystem state.\nA:H - Reading roughly a megabyte beyond the page-cache page routinely hits unmapped memory or KASAN redzones, producing a general protection fault, slab-out-of-bounds report, or panic — exactly the crash syzbot reported."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/jfs/jfs_dmap.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5bdb9553fb134fd52ec208a8b378120670f6e784","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a4f199203f79ca9cd7355799ccb26800174ff093","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1467a75819e41341cd5ebd16faa2af1ca3c8f4fe","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"49ea46d9025aa1914b24ea957636cbe4367a7311","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"173cfd741ad7073640bfb7e2344c2a0ee005e769","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c8ca21a2836993d7cb816668458e05e598574e55","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2dd05f09cc323018136a7ecdb3d1007be9ede27f","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"30e19a884c0b11f33821aacda7e72e914bec26ef","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c214006856ff52a8ff17ed8da52d50601d54f9ce","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/jfs/jfs_dmap.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.4.297","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.241","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.190","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.149","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.103","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.43","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.15.11","lessThanOrEqual":"6.15.*","status":"unaffected","versionType":"semver"},{"version":"6.16.2","lessThanOrEqual":"6.16.*","status":"unaffected","versionType":"semver"},{"version":"6.17","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.4.297"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.241"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.190"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.43"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.15.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.16.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.17"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/5bdb9553fb134fd52ec208a8b378120670f6e784"},{"url":"https://git.kernel.org/stable/c/a4f199203f79ca9cd7355799ccb26800174ff093"},{"url":"https://git.kernel.org/stable/c/1467a75819e41341cd5ebd16faa2af1ca3c8f4fe"},{"url":"https://git.kernel.org/stable/c/49ea46d9025aa1914b24ea957636cbe4367a7311"},{"url":"https://git.kernel.org/stable/c/173cfd741ad7073640bfb7e2344c2a0ee005e769"},{"url":"https://git.kernel.org/stable/c/c8ca21a2836993d7cb816668458e05e598574e55"},{"url":"https://git.kernel.org/stable/c/2dd05f09cc323018136a7ecdb3d1007be9ede27f"},{"url":"https://git.kernel.org/stable/c/30e19a884c0b11f33821aacda7e72e914bec26ef"},{"url":"https://git.kernel.org/stable/c/c214006856ff52a8ff17ed8da52d50601d54f9ce"}],"title":"jfs: upper bound check of tree index in dbAllocAG","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T17:41:26.028Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T12:05:34.355Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC CN 4100","versions":[{"status":"affected","version":"0","lessThan":"V5.0","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}]}}