CVE-2025-39735

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix slab-out-of-bounds read in ea_get()

During the "size_check" label in ea_get(), the code checks if the extended

attribute list (xattr) size matches ea_size. If not, it logs

"ea_get: invalid extended attribute" and calls print_hex_dump().

Here, EALIST_SIZE(ea_buf->xattr) returns 4110417968, which exceeds

INT_MAX (2,147,483,647). Then ea_size is clamped:

int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr));

Although clamp_t aims to bound ea_size between 0 and 4110417968, the upper

limit is treated as an int, causing an overflow above 2^31 - 1. This leads

"size" to wrap around and become negative (-184549328).

The "size" is then passed to print_hex_dump() (called "len" in

print_hex_dump()), it is passed as type size_t (an unsigned

type), this is then stored inside a variable called

"int remaining", which is then assigned to "int linelen" which

is then passed to hex_dump_to_buffer(). In print_hex_

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References