Data Race and Null Pointer Dereference in Linux Kernel's jbd2 Component

CVE-2025-38337

What is CVE-2025-38337?

The jbd2 component in the Linux kernel has a vulnerability that manifests as a data race and potential null pointer dereference within the jbd2_journal_dirty_metadata function. The issue arises because the transaction handle may point to a NULL value before it can be safely dereferenced. This flaw, combined with missing data-race annotations on jh->b_modified, can lead to unexpected behavior during metadata journaling. It is crucial for system administrators and developers to ensure that the corresponding patch is applied to mitigate associated risks.

References