CVE-2025-38697CWE-129

CVE-2025-38697

High · published September 4, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

jfs: upper bound check of tree index in dbAllocAG

When computing the tree index in dbAllocAG, we never check if we are

out of bounds realative to the size of the stree.

This could happen in a scenario where the filesystem metadata are

corrupted.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00184 · 7.6th percentile
Weakness
CWE-129 · Improper Validation of Array Index
Published
2025-09-04T20:15Z
Affected products (14)
ProductVersionsFixed in
linux/linux_kernel≥ 2.6.12.1, < 5.4.2975.4.297
linux/linux_kernel≥ 5.5, < 5.10.2415.10.241
linux/linux_kernel≥ 5.11, < 5.15.1905.15.190
linux/linux_kernel≥ 5.16, < 6.1.1496.1.149
linux/linux_kernel≥ 6.2, < 6.6.1036.6.103
linux/linux_kernel≥ 6.7, < 6.12.436.12.43
linux/linux_kernel≥ 6.13, < 6.15.116.15.11
linux/linux_kernel≥ 6.16, < 6.16.26.16.2
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
References (12)
EPSS history
Timeline
  • 04 SEP 15:32Z
    jfs: upper bound check of tree index in dbAllocAG
    cvelistv5