CVE-2025-38194

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

jffs2: check that raw node were preallocated before writing summary

Syzkaller detected a kernel bug in jffs2_link_node_ref, caused by fault

injection in jffs2_prealloc_raw_node_refs. jffs2_sum_write_sumnode doesn't

check return value of jffs2_prealloc_raw_node_refs and simply lets any

error propagate into jffs2_sum_write_data, which eventually calls

jffs2_link_node_ref in order to link the summary to an expectedly allocated

node.

kernel BUG at fs/jffs2/nodelist.c:592!

invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI

CPU: 1 PID: 31277 Comm: syz-executor.7 Not tainted 6.1.128-syzkaller-00139-ge10f83ca10a1 #0

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014

RIP: 0010:jffs2_link_node_ref+0x570/0x690 fs/jffs2/nodelist.c:592

Call Trace:

<TASK>

jffs2_sum_write_data fs/jffs2/summary.c:841 [inline]

jffs2_sum_write_sumnode+0xd1a/0x1da0 fs/jffs2/summary.c:874

jffs2_do_reserve_space+0xa18/0xd

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References