Invalid Pointer Dereference in Linux Kernel JFFS2 Implementation

CVE-2025-38328

What is CVE-2025-38328?

A vulnerability in the JFFS2 (Journaling Flash File System 2) of the Linux kernel allows for an invalid pointer dereference due to inadequate verification of the jffs2_prealloc_raw_node_refs() function's execution result. This oversight can lead to null pointer dereferences during memory allocation, potentially causing system instability or crashes. Appropriate error handling measures have been introduced to resolve this issue in later versions.

References