CVE-2025-38698

Vulnerability

CVE-2025-38698 addresses a flaw in the Linux kernel's JFS (Journaled File System) implementation. The issue arises when a file on disk is corrupted to have a negative i_size value, which then leads to subsequent file operations failing. The official description states that the reproducer builds such a corrupted file, and the fix adds a check when opening the file to prevent these failures [1].

Exploitation

No special network access is required; an attacker with the ability to create or modify a disk image with a crafted JFS filesystem could trigger the condition. When the corrupted file is opened, the kernel detects the negative i_size and, without the patch, would proceed with operations that may fail or cause unpredictable behavior.

Impact

The impact is limited to denial of service or operational failures on the affected system. The CVSS v3 base score of 5.5 (Medium) reflects the requirement for either physical or local access to mount the filesystem, and the potential for disruption of file system operations.

Mitigation

Siemens has listed its SIMATIC CN 4100 as an affected product and recommends updating to version V5.0 or later to remediate this and numerous other CVEs [1]. Linux kernel stable branches have been patched, as indicated by the kernel.org commit references.