CVE-2025-38697 is a high-severity vulnerability in the Linux kernel's JFS filesystem, specifically affecting Debian and Linux kernel versions. It stems from an unchecked tree index in the dbAllocAG function, which could lead to out-of-bounds access if filesystem metadata is corrupted. With a CVSS score of 7.8, this local vulnerability (AV:L) allows an attacker with low privileges (PR:L) to achieve high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). There is currently no known active exploitation, nor are there public Metasploit, Nuclei, or ExploitDB modules available, though it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.6.12.1, < 5.4.297CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.5, < 5.10.241CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.11, < 5.15.190CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.16, < 6.1.149CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.2, < 6.6.103CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Linux kernel (Azure) vulnerabilities
Mar 25, 2026Linux kernel (Azure FIPS) vulnerabilities
Mar 4, 2026Linux kernel (Azure) vulnerabilities
Mar 4, 2026Linux kernel (Xilinx) vulnerabilities
Feb 24, 2026Linux kernel (IBM) vulnerabilities
Feb 24, 2026jfs: upper bound check of tree index in dbAllocAG
Sep 9, 2025kernel: jfs: upper bound check of tree index in dbAllocAG
Sep 4, 2025