CVE-2025-39735

CVE-2025-39735 is a slab-out-of-bounds read vulnerability in the JFS filesystem's ea_get() function within the Linux kernel. This flaw occurs due to an integer overflow when clamping the extended attribute size, leading to a negative value being passed to print_hex_dump(). The corrupted length causes an extensive loop and subsequent out-of-bounds read in hex_dump_to_buffer(). The vulnerability is rated 7.1 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), indicating it can be exploited locally with low complexity by a low-privileged user, potentially leading to high confidentiality impact and high availability impact. The FAUCET Risk Score is 66/100, and the CWE is CWE-125. There is currently no evidence of active exploitation, nor are there known public exploits in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting low public awareness and attention for this vulnerability.