CVE-2025-37858
fs/jfs: Prevent integer overflow in AG size calculation
Description
In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Prevent integer overflow in AG size calculation The JFS filesystem calculates allocation group (AG) size using 1 << l2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with >2TB aggregates on 32-bit systems), this 32-bit shift operation causes undefined behavior and improper AG sizing. On 32-bit architectures: - Left-shifting 1 by 32+ bits results in 0 due to integer overflow - This creates invalid AG sizes (0 or garbage values) in sbi->bmap->db_agsize - Subsequent block allocations would reference invalid AG structures - Could lead to: - Filesystem corruption during extend operations - Kernel crashes due to invalid memory accesses - Security vulnerabilities via malformed on-disk structures Fix by casting to s64 before shifting: bmp->db_agsize = (s64)1 << l2agsize; This ensures 64-bit arithmetic even on 32-bit architectures. The cast matches the data type of db_agsize (s64) and follows similar patterns in JFS block calculation code. Found by Linux Verification Center (linuxtesting.org) with SVACE.
INFO
Published Date :
May 9, 2025, 7:16 a.m.
Last Modified :
Nov. 12, 2025, 8:09 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to the latest stable version.
- Apply the provided patch for the JFS filesystem.
- Recompile the kernel with the fix if necessary.
- Verify filesystem integrity after the update.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-37858.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-37858 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-37858
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-37858 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-37858 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 12, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-190 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.13.12 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.14 up to (excluding) 6.14.3 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.88 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.24 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 5.4.293 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.181 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.237 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.135 Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Added Reference Type kernel.org: https://git.kernel.org/stable/c/211ed8f5e39e61f9e4d18edd64ce8005a67a1b2a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/3d8a45f87010a802aa214bf39702ca9d99cbf3ba Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/55edbf5dbf60a8195c21e92124c4028939ae16b2 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7ccf3b35274512b60ecb614e0637e76bd6f2d829 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7fcbf789629cdb9fbf4e2172ce31136cfed11e5e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8bb29629a5e4090e1ef7199cb42db04a52802239 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c802a6a4009f585111f903e810b3be9c6d0da329 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/dd07a985e2ded47b6c7d69fc93c1fe02977c8454 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ec34cdf4f917cc6abd306cf091f8b8361fedac88 Types: Patch Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Types: Mailing List, Third Party Advisory Added Reference Type CVE: https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Types: Mailing List, Third Party Advisory -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 03, 2025
Action Type Old Value New Value Added Reference https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Added Reference https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 09, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Prevent integer overflow in AG size calculation The JFS filesystem calculates allocation group (AG) size using 1 << l2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with >2TB aggregates on 32-bit systems), this 32-bit shift operation causes undefined behavior and improper AG sizing. On 32-bit architectures: - Left-shifting 1 by 32+ bits results in 0 due to integer overflow - This creates invalid AG sizes (0 or garbage values) in sbi->bmap->db_agsize - Subsequent block allocations would reference invalid AG structures - Could lead to: - Filesystem corruption during extend operations - Kernel crashes due to invalid memory accesses - Security vulnerabilities via malformed on-disk structures Fix by casting to s64 before shifting: bmp->db_agsize = (s64)1 << l2agsize; This ensures 64-bit arithmetic even on 32-bit architectures. The cast matches the data type of db_agsize (s64) and follows similar patterns in JFS block calculation code. Found by Linux Verification Center (linuxtesting.org) with SVACE. Added Reference https://git.kernel.org/stable/c/211ed8f5e39e61f9e4d18edd64ce8005a67a1b2a Added Reference https://git.kernel.org/stable/c/3d8a45f87010a802aa214bf39702ca9d99cbf3ba Added Reference https://git.kernel.org/stable/c/55edbf5dbf60a8195c21e92124c4028939ae16b2 Added Reference https://git.kernel.org/stable/c/7ccf3b35274512b60ecb614e0637e76bd6f2d829 Added Reference https://git.kernel.org/stable/c/7fcbf789629cdb9fbf4e2172ce31136cfed11e5e Added Reference https://git.kernel.org/stable/c/8bb29629a5e4090e1ef7199cb42db04a52802239 Added Reference https://git.kernel.org/stable/c/c802a6a4009f585111f903e810b3be9c6d0da329 Added Reference https://git.kernel.org/stable/c/dd07a985e2ded47b6c7d69fc93c1fe02977c8454 Added Reference https://git.kernel.org/stable/c/ec34cdf4f917cc6abd306cf091f8b8361fedac88