CVE-2025-38328: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38328 is a NULL pointer dereference vulnerability in the Linux kernel's JFFS2 (Journaling Flash File System 2) subsystem, caused by missing return value checks on jffs2_prealloc_raw_node_refs(). When this memory allocation function fails, subsequent code proceeds under the assumption that node references were successfully allocated, leading to an invalid pointer dereference and potential kernel panic. The vulnerability was discovered via fuzzing by the Linux Verification Center (linuxtesting.org) using Syzkaller and disclosed on July 10, 2025. It affects Linux kernel versions from 2.6.18 through multiple stable branches up to 6.15.4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). The vulnerability exists in the JFFS2 filesystem code where jffs2_prealloc_raw_node_refs() is called in several locations without checking its return value for failure. If the allocation fails and returns an error, the subsequent call to jffs2_link_node_ref() (at fs/jffs2/nodelist.c:600) dereferences a null pointer in the range [0x0000000000000008–0x000000000000000f]. The attack vector is local, requiring low privileges and no user interaction, and is triggered through the write path: jffs2_write_end → jffs2_write_inode_range → jffs2_reserve_space → jffs2_garbage_collect_pass → jffs2_erase_pending_blocks → jffs2_mark_erased_block. The bug was confirmed via KASAN (Kernel Address Sanitizer) under a syzkaller fuzzing harness (Red Hat Bugzilla).

Successful exploitation causes a kernel null pointer dereference, resulting in a kernel panic and system crash — a denial of service condition. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems running affected kernel versions that mount JFFS2 filesystems (commonly used in embedded and flash-based storage environments) are at risk of being crashed by a local low-privileged user (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability was discovered through automated fuzzing (Syzkaller) rather than adversarial research. The EPSS score is 0.024% (very low probability of exploitation in the near term). It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges on a system using JFFS2 filesystems (Red Hat Advisory).

Patches have been released for all affected stable Linux kernel branches. Fixed versions include: 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, and 6.15.4. Administrators should update to the appropriate patched kernel version for their distribution. Ubuntu has issued security notices USN-7774-x and USN-7775-x series addressing this vulnerability. For systems that cannot be immediately patched, mitigations include restricting local user access, avoiding mounting untrusted JFFS2 filesystems, and implementing kernel module restrictions where possible (Red Hat Advisory, Ubuntu USN-7774-1, Ubuntu USN-7775-1).