Executive brief
The Linux kernel's JFS filesystem contains a vulnerability in its disk space allocation logic that can trigger an out-of-bounds array access. When processing certain malformed filesystem operations, an attacker with local access can crash the system or potentially execute code by triggering a memory access violation, disrupting service availability.
Technical details
The vulnerability is an array-index-out-of-bounds condition in the dbAllocDmapLev() function (fs/jfs/jfs_dmap.c:1965), where a negative array index (leafidx) is used to access dp->tree.stree[leafidx + LEAFIND] without bounds checking. The root cause is insufficient validation of the leafidx variable before array access. An attacker can trigger this via crafted filesystem operations (e.g., file creation with specific parameters) that lead to negative leafidx values. The fix adds a check to verify if leafidx is negative and returns an I/O error, preventing further execution. This is a local vulnerability requiring filesystem access, and patches are available in recent kernel versions.
Affected products
- Linux Linux kernel up to and including 6.4.0-rc6
Timeline
- 2025-10-01: disclosed: Vulnerability advisory published