In the Linux kernel, the following vulnerability has been resolved:
ocfs2: prevent release journal inode after journal shutdown
Before calling ocfs2deleteosb(), ocfs2journalshutdown() has already been executed in ocfs2dismountvolume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2journalreleasejbdinode().
ocfs2dismountvolume()-> ocfs2deleteosb()-> ocfs2freeslotinfo()-> _ocfs2freeslotinfo()-> evict()-> ocfs2evictinode()-> ocfs2clearinode()-> jbd2journalreleasejbdinode(osb->journal->jjournal,
Adding osb->journal checks will prevent null-ptr-deref during the above execution path.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39842.json"
}