CVE-2025-40312
Description
A flaw was found in the Linux kernel’s Journaled File System (JFS) handling code. When inode metadata is read from disk, the inode mode field was not properly validated. If the filesystem is corrupted and presents an invalid mode value, the kernel may accept and act on that invalid mode, potentially leading to unexpected behavior in file operations, memory corruption, or denial of service. This issue could be triggered by a local attacker with access to a crafted or corrupted JFS filesystem.
Mitigation
To mitigate this issue on Red Hat Enterprise Linux 6 ELS, prevent the JFS filesystem module from loading if it is not required. This can be achieved by blacklisting the `jfs` module.
To blacklist the `jfs` module:
1. Create a file named `/etc/modprobe.d/blacklist-jfs.conf` with the following content:
`blacklist jfs`
2. Regenerate the initramfs:
`dracut -f -v` (for systems using dracut)
`mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` (for systems using mkinitrd)
3. Reboot the system for the changes to take effect.
Note: Blacklisting the `jfs` module will prevent the system from mounting JFS filesystems. Ensure that no critical system operations rely on JFS before applying this mitigation.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
