CVE-2025-37858

Description

In the Linux kernel, the following vulnerability has been resolved: fs/jfs: Prevent integer overflow in AG size calculation The JFS filesystem calculates allocation group (AG) size using 1 << l2agsize in dbExtendFS(). When l2agsize exceeds 31 (possible with >2TB aggregates on 32-bit systems), this 32-bit shift operation causes undefined behavior and improper AG sizing. On 32-bit architectures: - Left-shifting 1 by 32+ bits results in 0 due to integer overflow - This creates invalid AG sizes (0 or garbage values) in sbi->bmap->db_agsize - Subsequent block allocations would reference invalid AG structures - Could lead to: - Filesystem corruption during extend operations - Kernel crashes due to invalid memory accesses - Security vulnerabilities via malformed on-disk structures Fix by casting to s64 before shifting: bmp->db_agsize = (s64)1 << l2agsize; This ensures 64-bit arithmetic even on 32-bit architectures. The cast matches the data type of db_agsize (s64) and follows similar patterns in JFS block calculation code. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reserved 2025-04-16 | Published 2025-05-09 | Updated 2025-05-09 | Assigner Linux

Product status

Default status
unaffected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before dd07a985e2ded47b6c7d69fc93c1fe02977c8454
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8bb29629a5e4090e1ef7199cb42db04a52802239
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3d8a45f87010a802aa214bf39702ca9d99cbf3ba
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 55edbf5dbf60a8195c21e92124c4028939ae16b2
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7ccf3b35274512b60ecb614e0637e76bd6f2d829
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c802a6a4009f585111f903e810b3be9c6d0da329
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 211ed8f5e39e61f9e4d18edd64ce8005a67a1b2a
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ec34cdf4f917cc6abd306cf091f8b8361fedac88
affected

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7fcbf789629cdb9fbf4e2172ce31136cfed11e5e
affected

Default status
affected

5.4.293
unaffected

5.10.237
unaffected

5.15.181
unaffected

6.1.135
unaffected

6.6.88
unaffected

6.12.24
unaffected

6.13.12
unaffected

6.14.3
unaffected

6.15-rc1
unaffected

References

git.kernel.org/...c/dd07a985e2ded47b6c7d69fc93c1fe02977c8454

git.kernel.org/...c/8bb29629a5e4090e1ef7199cb42db04a52802239

git.kernel.org/...c/3d8a45f87010a802aa214bf39702ca9d99cbf3ba

git.kernel.org/...c/55edbf5dbf60a8195c21e92124c4028939ae16b2

git.kernel.org/...c/7ccf3b35274512b60ecb614e0637e76bd6f2d829

git.kernel.org/...c/c802a6a4009f585111f903e810b3be9c6d0da329

git.kernel.org/...c/211ed8f5e39e61f9e4d18edd64ce8005a67a1b2a

git.kernel.org/...c/ec34cdf4f917cc6abd306cf091f8b8361fedac88

git.kernel.org/...c/7fcbf789629cdb9fbf4e2172ce31136cfed11e5e

cve.org (CVE-2025-37858)

nvd.nist.gov (CVE-2025-37858)

Download JSON