Array Index Out-of-Bounds Vulnerability in Linux Kernel

CVE-2025-38204

What is CVE-2025-38204?

A vulnerability has been identified in the Linux kernel affecting the JFS (Journaling File System) component. This issue arises due to an array-index-out-of-bounds read in the 'add_missing_indices' function. Specifically, it relates to the handling of offsets that can range from 0 to 127, leading to potential system instability. A bound check has been introduced to mitigate the risk, returning an error code (-EIO) if the check fails. This fix enhances the reliability of the JFS by ensuring that appropriate error handling is implemented during read operations.

References