CVE-2025-39743

HIGH

Linux Kernel - Denial of Service via JFS Inode Page Truncation

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to be triggered when executing clear_inode() because nrpages is greater than 0.

References (12)

Core 12
Core References

Scores

CVSS v3 7.8
EPSS 0.0001
EPSS Percentile 2.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Status published
Products (30)
debian/debian_linux 11.0
linux/Kernel 2.6.14 - 5.4.297linux
linux/Kernel 5.11.0 - 5.15.190linux
linux/Kernel 5.16.0 - 6.1.149linux
linux/Kernel 5.5.0 - 5.10.241linux
linux/Kernel 6.13.0 - 6.15.11linux
linux/Kernel 6.16.0 - 6.16.2linux
linux/Kernel 6.2.0 - 6.6.103linux
linux/Kernel 6.7.0 - 6.12.43linux
Linux/Linux < 2.6.14
... and 20 more
Published Sep 11, 2025
Tracked Since Feb 18, 2026