CVE-2025-37858 fs/jfs: Prevent integer overflow in AG size calculation
An integer overflow in the Linux kernel JFS filesystem allows attackers to cause crashes or potential code execution via malformed on-disk structures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-37858?
CVE-2025-37858 is a medium-severity vulnerability in Debian Debian Linux, published on 9 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/jfs: Prevent integer overflow in AG size calculation
The JFS filesystem calculates allocation group (AG) size using 1 << l2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with >2TB aggregates on 32-bit systems), this 32-bit shift operation causes undefined behavior and improper AG sizing.
On 32-bit architectures: - Left-shifting 1 by 32+ bits results in 0 due to integer overflow - This creates invalid AG sizes (0 or garbage values) in sbi->bmap->db_agsize - Subsequent block allocations would reference invalid AG structures - Could lead to: - Filesystem corruption during extend operations - Kernel crashes due to invalid memory accesses - Security vulnerabilities via malformed on-disk structures
Fix by casting to s64 before shifting: bmp->db_agsize = (s64)1 << l2agsize;
This ensures 64-bit arithmetic even on 32-bit architectures. The cast matches the data type of db_agsize (s64) and follows similar patterns in JFS block calculation code.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Weakness: CWE-190
Which versions are affected by CVE-2025-37858?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-37858?
Apply the vendor's patch.
Is CVE-2025-37858 being exploited?
There is no known exploitation of CVE-2025-37858 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-37858, DEBIAN-CVE-2025-37858, GHSA-886x-q2xh-8p43, ROOT-OS-DEBIAN-12-CVE-2025-37858, ROOT-OS-UBUNTU-2204-CVE-2025-37858, ROOT-OS-UBUNTU-2404-CVE-2025-37858 and 1 more.