CVE-2025-39842: ocfs2: prevent release journal inode after journal shutdown
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: prevent release journal inode after journal shutdown
Before calling ocfs2deleteosb(), ocfs2journalshutdown() has already been executed in ocfs2dismountvolume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2journalreleasejbdinode().
ocfs2dismountvolume()-> ocfs2deleteosb()-> ocfs2freeslotinfo()-> ocfs2freeslotinfo()-> evict()-> ocfs2evictinode()-> ocfs2clearinode()-> jbd2journalreleasejbdinode(osb->journal->jjournal,
Adding osb->journal checks will prevent null-ptr-deref during the above execution path.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39842?
CVE-2025-39842 is considered to have a high severity due to potential risks associated with the release of a journal inode after the journal shutdown in the Linux kernel.
How do I fix CVE-2025-39842?
To fix CVE-2025-39842, update your Linux kernel to a version where this vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-39842?
CVE-2025-39842 affects multiple versions of the Linux kernel before the patch was applied; always refer to your distribution's advisory for specific version details.
What impact does CVE-2025-39842 have on system security?
CVE-2025-39842 can lead to system instability and potential data loss, compromising overall system security.
Is CVE-2025-39842 exploitable remotely?
CVE-2025-39842 requires local access to the system for exploitation, which limits its impact to users with the ability to run code on the affected system.