CVE-2025-38230

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

jfs: validate AG parameters in dbMount() to prevent crashes

Validate db_agheight, db_agwidth, and db_agstart in dbMount to catch

corrupted metadata early and avoid undefined behavior in dbAllocAG.

Limits are derived from L2LPERCTL, LPERCTL/MAXAG, and CTLTREESIZE:

- agheight: 0 to L2LPERCTL/2 (0 to 5) ensures shift

(L2LPERCTL - 2*agheight) >= 0.

- agwidth: 1 to min(LPERCTL/MAXAG, 2^(L2LPERCTL - 2*agheight))

ensures agperlev >= 1.

- Ranges: 1-8 (agheight 0-3), 1-4 (agheight 4), 1 (agheight 5).

- LPERCTL/MAXAG = 1024/128 = 8 limits leaves per AG;

2^(10 - 2*agheight) prevents division to 0.

- agstart: 0 to CTLTREESIZE-1 - agwidth*(MAXAG-1) keeps ti within

stree (size 1365).

- Ranges: 0-1237 (agwidth 1), 0-348 (agwidth 8).

UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:1400:9

shift exponent -335544310 is negative

CPU: 0 UID: 0 PID: 5822 Comm: syz-executor130 Not tainted 6.14.0-rc5-syzkaller #0

Hardware

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References