Executive brief
The Linux kernel's JFS (Journaled File System) contains an integer overflow vulnerability in its disk block allocation code. An attacker with local access to a malicious JFS filesystem can trigger a crash or potentially execute code by providing crafted filesystem metadata that causes an out-of-bounds bit shift operation during block allocation. This impacts the availability and stability of any system using JFS volumes.
Technical details
The vulnerability is a shift-out-of-bounds error in the dbAllocAG function within fs/jfs/jfs_dmap.c, caused by insufficient validation of the bmp->db_agl2size field read from on-disk JFS metadata during filesystem mount. This field, which represents a logarithmic size value, was not checked to ensure it remained within valid bounds (must be ≤ L2MAXL2SIZE - L2MAXAG). When db_agl2size exceeds 64, subsequent bit shift operations using this value trigger undefined behavior and kernel crash via UBSAN. The fix adds explicit bounds validation in the dbMount function before the problematic field is used in downstream allocation operations. Attack requires local filesystem access and ability to mount a crafted JFS volume; no network vector or privilege escalation is inherent.
Affected products
- Linux Linux kernel multiple versions with JFS support
Timeline
- 2025-10-22: disclosed
- 2022-12-31: patched