CVE-2025-38337: jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()

Published Jul 10, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

jbd2: fix data-race and null-ptr-deref in jbd2journaldirtymetadata()

Since handle->htransaction may be a NULL pointer, so we should change it to call ishandleaborted(handle) first before dereferencing it.

And the following data-race was reported in my fuzzer:

================================================================== BUG: KCSAN: data-race in jbd2journaldirtymetadata / jbd2journaldirtymetadata

write to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1: jbd2journaldirtymetadata+0x2a5/0x770 fs/jbd2/transaction.c:1556 ext4handledirtymetadata+0xe7/0x4b0 fs/ext4/ext4jbd2.c:358 ext4doupdateinode fs/ext4/inode.c:5220 [inline] ext4markilocdirty+0x32c/0xd50 fs/ext4/inode.c:5869 ext4markinodedirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4dirtyinode+0x98/0xc0 fs/ext4/inode.c:6103 ....

read to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0: jbd2journaldirtymetadata+0xf2/0x770 fs/jbd2/transaction.c:1512 ext4handledirtymetadata+0xe7/0x4b0 fs/ext4/ext4jbd2.c:358 ext4doupdateinode fs/ext4/inode.c:5220 [inline] ext4markilocdirty+0x32c/0xd50 fs/ext4/inode.c:5869 ext4markinodedirty+0xe1/0x450 fs/ext4/inode.c:6074 ext4dirtyinode+0x98/0xc0 fs/ext4/inode.c:6103 ....

value changed: 0x00000000 -> 0x00000001 ==================================================================

This issue is caused by missing data-race annotation for jh->bmodified. Therefore, the missing annotation needs to be added.

Affected Software

10 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=4.3<5.4.295
Linux Linux kernel>=5.5<5.10.239
Linux Linux kernel>=5.11<5.15.186
Linux Linux kernel>=5.16<6.1.142
Linux Linux kernel>=6.2<6.6.95
Linux Linux kernel>=6.7<6.12.35
Linux Linux kernel>=6.13<6.15.4
Debian Debian Linux=11.0
debian/linux
6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1

Event History

Jul 10, 2025
CVE Published
via MITRE·08:15 AM
Data Sourced
via MITRE·08:15 AM
Description
Data Sourced
via NVD·09:15 AM
RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2025-38337?

CVE-2025-38337 is classified as a high severity vulnerability due to the potential for null pointer dereference leading to denial of service.

2

How do I fix CVE-2025-38337?

To fix CVE-2025-38337, update the Linux kernel to the latest stable version that includes the patch resolving the issue.

3

What software is affected by CVE-2025-38337?

CVE-2025-38337 affects the Linux kernel, specifically impacting functionality related to jbd2 journaling.

4

What are the potential risks of CVE-2025-38337?

The potential risks of CVE-2025-38337 include system crashes and data loss due to abrupt termination of processes handling journaled data.

5

Is there a workaround for CVE-2025-38337?

Currently, there are no known effective workarounds for CVE-2025-38337; the best course of action is to apply the security patch.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203