CVE-2025-38328

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

jffs2: check jffs2_prealloc_raw_node_refs() result in few other places

Fuzzing hit another invalid pointer dereference due to the lack of

checking whether jffs2_prealloc_raw_node_refs() completed successfully.

Subsequent logic implies that the node refs have been allocated.

Handle that. The code is ready for propagating the error upwards.

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]

CPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014

RIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600

Call Trace:

jffs2_mark_erased_block fs/jffs2/erase.c:460 [inline]

jffs2_erase_pending_blocks+0x688/0x1860 fs/jffs2/erase.c:118

jffs2_garbage_collect_pass+0x638/0x1a00 fs/jffs2/gc.c:253

jffs2_reserve_space+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167

jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References