Executive brief
The Linux kernel's JFS filesystem implementation has a double-free vulnerability in its unmount routine. When a JFS filesystem remount fails after initially freeing an imap structure, the code attempts to free the same memory region twice, causing a kernel crash or potential security compromise. This affects systems using JFS filesystems during error conditions or malicious remount operations.
Technical details
The vulnerability is a use-after-free / double-free in the jfs_imap.c diUnmount() function. The root cause is that JFS_IP(ipimap)->i_imap is freed but the pointer is not zeroed, allowing a subsequent call (e.g., during failed remount in jfs_remount → diMount path) to free the same memory again. This triggers a KASAN double-free error in the slab allocator. The attack vector requires local access to trigger filesystem remount operations. The vulnerability was resolved by ensuring the pointer is set to NULL after the initial free, preventing the second free attempt.
Affected products
- Linux Linux kernel 6.1.0-rc7 and likely earlier versions with JFS support
Timeline
- 2025-10-04: disclosed