Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-38328

jffs2: check jffs2_prealloc_raw_node_refs() result in few other places

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: jffs2: check jffs2_prealloc_raw_node_refs() result in few other places Fuzzing hit another invalid pointer dereference due to the lack of checking whether jffs2_prealloc_raw_node_refs() completed successfully. Subsequent logic implies that the node refs have been allocated. Handle that. The code is ready for propagating the error upwards. KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600 Call Trace: jffs2_mark_erased_block fs/jffs2/erase.c:460 [inline] jffs2_erase_pending_blocks+0x688/0x1860 fs/jffs2/erase.c:118 jffs2_garbage_collect_pass+0x638/0x1a00 fs/jffs2/gc.c:253 jffs2_reserve_space+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167 jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362 jffs2_write_end+0x712/0x1110 fs/jffs2/file.c:302 generic_perform_write+0x2c2/0x500 mm/filemap.c:3347 __generic_file_write_iter+0x252/0x610 mm/filemap.c:3465 generic_file_write_iter+0xdb/0x230 mm/filemap.c:3497 call_write_iter include/linux/fs.h:2039 [inline] do_iter_readv_writev+0x46d/0x750 fs/read_write.c:740 do_iter_write+0x18c/0x710 fs/read_write.c:866 vfs_writev+0x1db/0x6a0 fs/read_write.c:939 do_pwritev fs/read_write.c:1036 [inline] __do_sys_pwritev fs/read_write.c:1083 [inline] __se_sys_pwritev fs/read_write.c:1078 [inline] __x64_sys_pwritev+0x235/0x310 fs/read_write.c:1078 do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 2f785402f39b96a077b6e62bf26164bfb8e0c980 to < 7e860296d7808de1db175c1eda29f94a2955dcc4affected
  • 2f785402f39b96a077b6e62bf26164bfb8e0c980 to < d96e6451a8d0fe62492d4cc942d695772293c05aaffected
  • 2f785402f39b96a077b6e62bf26164bfb8e0c980 to < f41c625328777f9ad572901ba0b0065bb9c9c1daaffected
  • 2f785402f39b96a077b6e62bf26164bfb8e0c980 to < 38d767fb4a7766ec2058f97787e4c6e8d10343d6affected
  • 2f785402f39b96a077b6e62bf26164bfb8e0c980 to < cd42ddddd70abc7127c12b96c8c85dbd080ea56faffected
  • 2f785402f39b96a077b6e62bf26164bfb8e0c980 to < d1b81776f337a9b997f797c70ac0a26d838a2168affected
  • 2f785402f39b96a077b6e62bf26164bfb8e0c980 to < 042fa922c84b5080401bcd8897d4ac4919d15075affected
  • 2f785402f39b96a077b6e62bf26164bfb8e0c980 to < 2b6d96503255a3ed676cd70f8368870c6d6a25c6affected

Linux Linux

Default version status: affected

  • 2.6.18affected
  • 0 to < 2.6.18unaffected
  • 5.4.295 to ≤ 5.4.*unaffected
  • 5.10.239 to ≤ 5.10.*unaffected
  • 5.15.186 to ≤ 5.15.*unaffected
  • 6.1.142 to ≤ 6.1.*unaffected
  • 6.6.95 to ≤ 6.6.*unaffected
  • 6.12.35 to ≤ 6.12.*unaffected
  • 6.15.4 to ≤ 6.15.*unaffected
  • 6.16 to ≤ *unaffected

References