CVE-2025-39842

Vulnerability

Overview

CVE-2025-39842 is a null-pointer dereference vulnerability in the Linux kernel's Oracle Cluster File System 2 (ocfs2). The root cause is a missing check for osb->journal being NULL after ocfs2_journal_shutdown() has been called during the unmount sequence. When ocfs2_dismount_volume() calls ocfs2_journal_shutdown(), the journal pointer is set to NULL. Subsequently, ocfs2_delete_osb() triggers a call chain that eventually reaches jbd2_journal_release_jbd_inode(), which dereferences the now-NULL journal pointer, causing a crash [1][2].

Exploitation

Conditions

An attacker would need to be able to trigger the unmount of an ocfs2 filesystem, which typically requires local access and the ability to unmount a volume. The vulnerability is triggered during normal system shutdown or filesystem unmount operations, not through remote exploitation. No authentication is required beyond the ability to execute the unmount command [1].

Impact

If exploited, this vulnerability leads to a kernel panic (denial of service) due to the null-pointer dereference. The system becomes unavailable until reboot. There is no evidence of privilege escalation or data corruption from this bug [1].

Mitigation

The fix adds a simple NULL check for osb->journal before calling jbd2_journal_release_jbd_inode(), preventing the dereference. The patch has been applied to the Linux kernel stable branches [2][3][4]. Users should update to a kernel version containing the fix. Siemens has also listed this CVE as affecting SIMATIC CN 4100 devices running versions before V5.0, and recommends updating to V5.0 or later [1].