CVE-2025-38194

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.1.128

Description: A bug in the jffs2 file system has been detected, caused by a fault injection in jffs2 prealloc raw node refs. The function jffs2 sum write sumnode does not check the return value of jffs2 prealloc raw node refs, allowing any error to propagate into jffs2 sum write data, which eventually calls jffs2 link node ref. This can lead to a kernel bug. The issue was found by the Linux Verification Center with Syzkaller.

Recommendations: To resolve this issue, check the return value of jffs2 prealloc raw node refs before calling jffs2 sum write data. As a temporary workaround, consider disabling the jffs2 link node ref function until a patch is available. Restrict access to the vulnerable jffs2 module to minimize the risk of exploitation.