CVE-2025-38337 — NULL Pointer Dereference in Linux
Severity
5.5MEDIUMNVD
OSV5.6OSV3.2
EPSS
0.0%
top 86.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 10
Latest updateMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
Since handle->h_transaction may be a NULL pointer, so we should change it
to call is_handle_aborted(handle) first before dereferencing it.
And the following data-race was reported in my fuzzer:
BUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata
write to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1:
jbd2_journal_di…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux6e06ae88edae77379bef7c0cb7d3c2dd88676867 — 5c1a34ff5b0bfdfd2f9343aa9b08d25df618bac5+8
Also affects: Debian Linux 11.0