Null Pointer Dereference Vulnerability in JFS Module for Linux Kernel

CVE-2025-38203

What is CVE-2025-38203?

A concurrency bug in the JFS module of the Linux kernel can lead to a null pointer dereference, potentially causing a kernel panic and system instability. This occurs when the bmap is set to NULL, which can be triggered under specific circumstances, particularly from workload interleavings or when executed through fuzzing techniques. This vulnerability can affect systems running the Linux kernel versions with JFS enabled, necessitating immediate updates and mitigations.

References