{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"5c1a34ff5b0bfdfd2f9343aa9b08d25df618bac5","status":"affected","version":"6e06ae88edae77379bef7c0cb7d3c2dd88676867","versionType":"git"},{"lessThan":"ec669e5bf409f16e464bfad75f0ba039a45de29a","status":"affected","version":"6e06ae88edae77379bef7c0cb7d3c2dd88676867","versionType":"git"},{"lessThan":"43d5e3bb5f1dcd91e30238ea0b59a5f77063f84e","status":"affected","version":"6e06ae88edae77379bef7c0cb7d3c2dd88676867","versionType":"git"},{"lessThan":"23361b479f2700c00960d3ae9cdc8ededa762d47","status":"affected","version":"6e06ae88edae77379bef7c0cb7d3c2dd88676867","versionType":"git"},{"lessThan":"2e7c64d7a92c031d016f11c8e8cb05131ab7b75a","status":"affected","version":"6e06ae88edae77379bef7c0cb7d3c2dd88676867","versionType":"git"},{"lessThan":"f78b38af3540b4875147b7b884ee11a27b3dbf4c","status":"affected","version":"6e06ae88edae77379bef7c0cb7d3c2dd88676867","versionType":"git"},{"lessThan":"a377996d714afb8d4d5f4906336f78510039da29","status":"affected","version":"6e06ae88edae77379bef7c0cb7d3c2dd88676867","versionType":"git"},{"lessThan":"af98b0157adf6504fade79b3e6cb260c4ff68e37","status":"affected","version":"6e06ae88edae77379bef7c0cb7d3c2dd88676867","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"4.3"},{"lessThan":"4.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.295","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.239","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.186","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.142","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.95","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.35","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2025-38337","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()\n\nSince handle->h_transaction may be a NULL pointer, so we should change it\nto call is_handle_aborted(handle) first before dereferencing it.\n\nAnd the following data-race was reported in my fuzzer:\n\n==================================================================\nBUG: KCSAN: data-race in jbd2_journal_dirty_metadata / jbd2_journal_dirty_metadata\n\nwrite to 0xffff888011024104 of 4 bytes by task 10881 on cpu 1:\n jbd2_journal_dirty_metadata+0x2a5/0x770 fs/jbd2/transaction.c:1556\n __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358\n ext4_do_update_inode fs/ext4/inode.c:5220 [inline]\n ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869\n __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074\n ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103\n....\n\nread to 0xffff888011024104 of 4 bytes by task 10880 on cpu 0:\n jbd2_journal_dirty_metadata+0xf2/0x770 fs/jbd2/transaction.c:1512\n __ext4_handle_dirty_metadata+0xe7/0x4b0 fs/ext4/ext4_jbd2.c:358\n ext4_do_update_inode fs/ext4/inode.c:5220 [inline]\n ext4_mark_iloc_dirty+0x32c/0xd50 fs/ext4/inode.c:5869\n __ext4_mark_inode_dirty+0xe1/0x450 fs/ext4/inode.c:6074\n ext4_dirty_inode+0x98/0xc0 fs/ext4/inode.c:6103\n....\n\nvalue changed: 0x00000000 -> 0x00000001\n==================================================================\n\nThis issue is caused by missing data-race annotation for jh->b_modified.\nTherefore, the missing annotation needs to be added.","epss":{"date":"2026-11-05","percentile":0.09351,"score":0.00196},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793912553964,"publishedAt":1752135308396,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/5c1a34ff5b0bfdfd2f9343aa9b08d25df618bac5"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/ec669e5bf409f16e464bfad75f0ba039a45de29a"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/43d5e3bb5f1dcd91e30238ea0b59a5f77063f84e"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/23361b479f2700c00960d3ae9cdc8ededa762d47"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/2e7c64d7a92c031d016f11c8e8cb05131ab7b75a"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f78b38af3540b4875147b7b884ee11a27b3dbf4c"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/a377996d714afb8d4d5f4906336f78510039da29"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/af98b0157adf6504fade79b3e6cb260c4ff68e37"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"remediation":[],"revision":"4081e02022163d2ce1f5e5c3d0699e02ca1e07d41ded7188954f020a961537c5","sources":[{"modifiedAt":1793912553964,"name":"CNA: Linux","retrievedAt":1793913666540,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38337"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913670029,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38337"}],"ssvc":{"assessedAt":1793912096222,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()","updatedAt":1793913670029}