CVE-2025-38204

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The attack requires a crafted JFS image to be presented to and mounted on the local system (loop device, or removable media auto-mounted by udisks2/autofs on a kiosk or shared workstation), after which the trigger is an ordinary local getdents64() syscall on a directory. There is no network or remote-peer input path into jfs_readdir()/add_missing_indices().

AC:LAttack complexity, low

Every controlling value — the negative stbl[] entries, the starting slot in the dir_table entry that makes readdir skip them, the out-of-range d->index that sets fix_page, and next_index — is read verbatim from the attacker's image, so the out-of-bounds access is fully deterministic with no race, timing, or memory-layout condition outside the attacker's control.

PR:NPrivileges required, none

The attacker only has to author the filesystem image and needs no account or privilege on the target; once mounted, the vulnerable path is reached by an unprivileged readdir with no capable() or permission check anywhere between the syscall and add_missing_indices().

UI:RUser interaction, required

A user or an automounter on the victim system must mount the malicious JFS image read-write before the corrupted dtree page is ever ingested; on a desktop the file manager then issues the getdents that trips the bug without further action.

S:UScope, unchanged

The out-of-bounds read, the out-of-bounds write, and the corrupted journal records are all confined to the kernel's own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

The negative index reads kernel memory up to 4064 bytes before the metapage folio, and because lv->offset is u8 the same value makes lmWriteRecord() memcpy 32 bytes from up to 4064 bytes past the metapage into the journal, persisting kernel heap contents onto storage the attacker supplied and can read back — far beyond a bounded few-byte read.

I:HIntegrity impact, high

When the out-of-bounds-read d->index fails the (2 <= index < next_index) test — which arbitrary adjacent heap data almost always does — the code performs a 4-byte out-of-bounds write of add_index()'s return value at an attacker-chosen 32-byte-aligned offset among 128 possible slots before the metapage, giving a groomable heap corruption primitive in addition to the bogus linelock that corrupts the on-disk journal.

A:HAvailability impact, high

The wild read and write reach adjacent page-cache folios and other kernel allocations, producing a KASAN report/oops or corrupting live kernel structures, and the malformed journal line-vector writes garbage into the log; the attacker can repeat the readdir arbitrarily, so a kernel panic is readily achievable.