In the Linux kernel, the following vulnerability has been resolved:
jfs: validate AG parameters in dbMount() to prevent crashes
Validate dbagheight, dbagwidth, and db_agstart in dbMount to catch corrupted metadata early and avoid undefined behavior in dbAllocAG. Limits are derived from L2LPERCTL, LPERCTL/MAXAG, and CTLTREESIZE:
UBSAN: shift-out-of-bounds in fs/jfs/jfsdmap.c:1400:9 shift exponent -335544310 is negative CPU: 0 UID: 0 PID: 5822 Comm: syz-executor130 Not tainted 6.14.0-rc5-syzkaller #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: <TASK> _dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 ubsanepilogue lib/ubsan.c:231 [inline] _ubsanhandleshiftoutofbounds+0x3c8/0x420 lib/ubsan.c:468 dbAllocAG+0x1087/0x10b0 fs/jfs/jfsdmap.c:1400 dbDiscardAG+0x352/0xa20 fs/jfs/jfsdmap.c:1613 jfsioctrim+0x45a/0x6b0 fs/jfs/jfsdiscard.c:105 jfsioctl+0x2cd/0x3e0 fs/jfs/ioctl.c:131 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:906 [inline] _sesysioctl+0xf5/0x170 fs/ioctl.c:892 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x77/0x7f
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
[
{
"id": "CVE-2025-38230-064f5751",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c40fa81f850556e9aa0185fede9ef1112db7b39",
"digest": {
"line_hashes": [
"320482616584230425902787280388970378200",
"203283033857702652177330797079211441788",
"272930872074712390462352087753159106537",
"284844579320206479959230682853538718813"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-09b8da23",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b62a1e59d8716bbd2e73660743fe06acc97ed7d1",
"digest": {
"length": 1968.0,
"function_hash": "210058063289698429637174460619751387764"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-2b81f82e",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3705c82b7406a15ef38a610d03bf6baa43d6e0c",
"digest": {
"line_hashes": [
"320482616584230425902787280388970378200",
"203283033857702652177330797079211441788",
"272930872074712390462352087753159106537",
"284844579320206479959230682853538718813"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-35527fd7",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c40fa81f850556e9aa0185fede9ef1112db7b39",
"digest": {
"length": 1968.0,
"function_hash": "210058063289698429637174460619751387764"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-37a3537a",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9242ff6245527a3ebb693ddd175493b38ddca72f",
"digest": {
"line_hashes": [
"320482616584230425902787280388970378200",
"203283033857702652177330797079211441788",
"272930872074712390462352087753159106537",
"284844579320206479959230682853538718813"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-48c61145",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b62a1e59d8716bbd2e73660743fe06acc97ed7d1",
"digest": {
"line_hashes": [
"320482616584230425902787280388970378200",
"203283033857702652177330797079211441788",
"272930872074712390462352087753159106537",
"284844579320206479959230682853538718813"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-5019790b",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95ae5ee6069d9a5945772625f289422ef659221a",
"digest": {
"line_hashes": [
"320482616584230425902787280388970378200",
"203283033857702652177330797079211441788",
"272930872074712390462352087753159106537",
"284844579320206479959230682853538718813"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-605236d2",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b69608c6b6779a7ab07ce4467a56df90152cfb9",
"digest": {
"length": 1968.0,
"function_hash": "210058063289698429637174460619751387764"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-67411b0f",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95ae5ee6069d9a5945772625f289422ef659221a",
"digest": {
"length": 1968.0,
"function_hash": "210058063289698429637174460619751387764"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-707c6b78",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4259e72363e1ea204a97292001a9fc36c7e52fd",
"digest": {
"length": 1968.0,
"function_hash": "210058063289698429637174460619751387764"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-738d428e",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4259e72363e1ea204a97292001a9fc36c7e52fd",
"digest": {
"line_hashes": [
"320482616584230425902787280388970378200",
"203283033857702652177330797079211441788",
"272930872074712390462352087753159106537",
"284844579320206479959230682853538718813"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-7ddb6695",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3705c82b7406a15ef38a610d03bf6baa43d6e0c",
"digest": {
"length": 1968.0,
"function_hash": "210058063289698429637174460619751387764"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-8072430c",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b69608c6b6779a7ab07ce4467a56df90152cfb9",
"digest": {
"line_hashes": [
"320482616584230425902787280388970378200",
"203283033857702652177330797079211441788",
"272930872074712390462352087753159106537",
"284844579320206479959230682853538718813"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-9a83007e",
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37bfb464ddca87f203071b5bd562cd91ddc0b40a",
"digest": {
"line_hashes": [
"320482616584230425902787280388970378200",
"203283033857702652177330797079211441788",
"272930872074712390462352087753159106537",
"284844579320206479959230682853538718813"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-b57c6387",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9242ff6245527a3ebb693ddd175493b38ddca72f",
"digest": {
"length": 1968.0,
"function_hash": "210058063289698429637174460619751387764"
},
"signature_version": "v1"
},
{
"id": "CVE-2025-38230-cbd9dfde",
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "fs/jfs/jfs_dmap.c",
"function": "dbMount"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37bfb464ddca87f203071b5bd562cd91ddc0b40a",
"digest": {
"length": 1968.0,
"function_hash": "210058063289698429637174460619751387764"
},
"signature_version": "v1"
}
]