CVE-2025-38337

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()

Since handle->h_transaction may be a NULL pointer, so we should change it

to call is_handle_aborted(handle) first before dereferencing it.

And the following data-race was reported in my fuzzer:

==================================================================

BUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata

write to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1:

jbd2_journal_dirty_metadata+0x2a5/0x770 fs/jbd2/transaction.c:1556

__ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358

ext4_do_update_inode fs/ext4/inode.c:5220 [inline]

ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869

__ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074

ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103

....

read to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0:

jbd2_journal_dirty_metadata+0xf2/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References