CVE-2025-38328
published 2025-07-10CVE-2025-38328: In the Linux kernel, the following vulnerability has been resolved: jffs2: check jffs2_prealloc_raw_node_refs() result in few other places Fuzzing hit another…
medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved:
jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
Fuzzing hit another invalid pointer dereference due to the lack of
checking whether jffs2_prealloc_raw_node_refs() completed successfully.
Subsequent logic implies that the node refs have been allocated.
Handle that. The code is ready for propagating the error upwards.
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600
Call Trace:
jffs2_mark_erased_block fs/jffs2/erase.c:460 [inline]
jffs2_erase_pending_blocks+0x688/0x1860 fs/jffs2/erase.c:118
jffs2_garbage_collect_pass+0x638/0x1a00 fs/jffs2/gc.c:253
jffs2_reserve_space+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167
jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362
jffs2_write_end+0x712/0x1110 fs/jffs2/file.c:302
generic_perform_write+0x2c2/0x500 mm/filemap.c:3347
__generic_file_write_iter+0x252/0x610 mm/filemap.c:3465
generic_file_write_iter+0xdb/0x230 mm/filemap.c:3497
call_write_iter include/linux/fs.h:2039 [inline]
do_iter_readv_writev+0x46d/0x750 fs/read_write.c:740
do_iter_write+0x18c/0x710 fs/read_write.c:866
vfs_writev+0x1db/0x6a0 fs/read_write.c:939
do_pwritev fs/read_write.c:1036 [inline]
__do_sys_pwritev fs/read_write.c:1083 [inline]
__se_sys_pwritev fs/read_write.c:1078 [inline]
__x64_sys_pwritev+0x235/0x310 fs/read_write.c:1078
do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 2f785402f39b96a077b6e62bf26164bfb8e0c980 < 7e860296d7808de1db175c1eda29f94a2955dcc4 | 7e860296d7808de1db175c1eda29f94a2955dcc4 |
| linux | linux | >= 2f785402f39b96a077b6e62bf26164bfb8e0c980 < d96e6451a8d0fe62492d4cc942d695772293c05a | d96e6451a8d0fe62492d4cc942d695772293c05a |
| linux | linux | >= 2f785402f39b96a077b6e62bf26164bfb8e0c980 < f41c625328777f9ad572901ba0b0065bb9c9c1da | f41c625328777f9ad572901ba0b0065bb9c9c1da |
| linux | linux | >= 2f785402f39b96a077b6e62bf26164bfb8e0c980 < 38d767fb4a7766ec2058f97787e4c6e8d10343d6 | 38d767fb4a7766ec2058f97787e4c6e8d10343d6 |
| linux | linux | >= 2f785402f39b96a077b6e62bf26164bfb8e0c980 < cd42ddddd70abc7127c12b96c8c85dbd080ea56f | cd42ddddd70abc7127c12b96c8c85dbd080ea56f |
| linux | linux | >= 2f785402f39b96a077b6e62bf26164bfb8e0c980 < d1b81776f337a9b997f797c70ac0a26d838a2168 | d1b81776f337a9b997f797c70ac0a26d838a2168 |
| linux | linux | >= 2f785402f39b96a077b6e62bf26164bfb8e0c980 < 042fa922c84b5080401bcd8897d4ac4919d15075 | 042fa922c84b5080401bcd8897d4ac4919d15075 |
| linux | linux | >= 2f785402f39b96a077b6e62bf26164bfb8e0c980 < 2b6d96503255a3ed676cd70f8368870c6d6a25c6 | 2b6d96503255a3ed676cd70f8368870c6d6a25c6 |
| linux | linux_kernel | >= 0 < 5.10.244-1 | 5.10.244-1 |
| linux | linux_kernel | >= 0 < 6.1.147-1 | 6.1.147-1 |
| linux | linux_kernel | >= 0 < 6.12.35-1 | 6.12.35-1 |
| linux | linux_kernel | >= 0 < 6.12.35-1 | 6.12.35-1 |
| linux | linux_kernel | >= 0 < 5.15.0-156.166 | 5.15.0-156.166 |
| linux | linux_kernel | >= 0 < 6.8.0-100.100 | 6.8.0-100.100 |
| linux | linux_kernel | >= 2.6.18 < 5.4.295 | 5.4.295 |
| linux | linux_kernel | >= 5.11 < 5.15.186 | 5.15.186 |
| linux | linux_kernel | >= 5.16 < 6.1.142 | 6.1.142 |
| linux | linux_kernel | >= 5.5 < 5.10.239 | 5.10.239 |
| linux | linux_kernel | >= 6.13 < 6.15.4 | 6.15.4 |
| linux | linux_kernel | >= 6.2 < 6.6.95 | 6.6.95 |
| linux | linux_kernel | >= 6.7 < 6.12.35 | 6.12.35 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.6MEDIUM