CVE-2025-37858

Summary

In the Linux kernel, the following vulnerability has been resolved:

fs/jfs: Prevent integer overflow in AG size calculation

The JFS filesystem calculates allocation group (AG) size using 1 << l2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with >2TB aggregates on 32-bit systems), this 32-bit shift operation causes undefined behavior and improper AG sizing.

On 32-bit architectures:

  • Left-shifting 1 by 32+ bits results in 0 due to integer overflow
  • This creates invalid AG sizes (0 or garbage values) in sbi->bmap->db_agsize
  • Subsequent block allocations would reference invalid AG structures
  • Could lead to:
    • Filesystem corruption during extend operations
    • Kernel crashes due to invalid memory accesses
    • Security vulnerabilities via malformed on-disk structures

Fix by casting to s64 before shifting: bmp->db_agsize = (s64)1 << l2agsize;

This ensures 64-bit arithmetic even on 32-bit architectures. The cast matches the data type of db_agsize (s64) and follows similar patterns in JFS block calculation code.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < dd07a985e2ded47b6c7d69fc93c1fe02977c8454affected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8bb29629a5e4090e1ef7199cb42db04a52802239affected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3d8a45f87010a802aa214bf39702ca9d99cbf3baaffected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 55edbf5dbf60a8195c21e92124c4028939ae16b2affected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7ccf3b35274512b60ecb614e0637e76bd6f2d829affected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c802a6a4009f585111f903e810b3be9c6d0da329affected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 211ed8f5e39e61f9e4d18edd64ce8005a67a1b2aaffected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ec34cdf4f917cc6abd306cf091f8b8361fedac88affected
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7fcbf789629cdb9fbf4e2172ce31136cfed11e5eaffected
LinuxLinux2.6.12affected
LinuxLinux0 < 2.6.12unaffected
LinuxLinux5.4.293 <= 5.4.*unaffected
LinuxLinux5.10.237 <= 5.10.*unaffected
LinuxLinux5.15.181 <= 5.15.*unaffected
LinuxLinux6.1.135 <= 6.1.*unaffected
LinuxLinux6.6.88 <= 6.6.*unaffected
LinuxLinux6.12.24 <= 6.12.*unaffected
LinuxLinux6.13.12 <= 6.13.*unaffected
LinuxLinux6.14.3 <= 6.14.*unaffected
LinuxLinux6.15 <= *unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

References