CVE-2025-38204 jfs: fix array-index-out-of-bounds read in add_missing_indices
A local attacker can trigger an out-of-bounds read in the JFS filesystem, potentially causing a system crash or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-38204?
CVE-2025-38204 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 4 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
jfs: fix array-index-out-of-bounds read in add_missing_indices
stbl is s8 but it must contain offsets into slot which can go from 0 to 127.
Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.
Weakness: CWE-125
Which versions are affected by CVE-2025-38204?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38204?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-38204 being exploited?
There is no known exploitation of CVE-2025-38204 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-38204, DEBIAN-CVE-2025-38204, GHSA-362h-j6ww-x5f8, ROOT-OS-DEBIAN-11-CVE-2025-38204, ROOT-OS-DEBIAN-12-CVE-2025-38204, ROOT-OS-DEBIAN-13-CVE-2025-38204 and 3 more.