CVE-2025-38204
Description
From CVE.org
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read in add_missing_indices stbl is s8 but it must contain offsets into slot which can go from 0 to 127. Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.
Statement
This flaw presents minimal risk to Red Hat environments because the legacy JFS file system is not enabled or compiled in Red Hat Enterprise Linux kernels. In environments where JFS is active, an attacker with local privileges could mount a corrupted file system image to trigger an out-of-bounds memory read during directory operations, potentially resulting in a kernel crash or memory leakage. Because the relevant file system driver is omitted entirely from Red Hat Enterprise Linux builds, supported Red Hat products are not affected.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
