{"id":"DEBIAN-CVE-2025-38328","details":"In the Linux kernel, the following vulnerability has been resolved:  jffs2: check jffs2_prealloc_raw_node_refs() result in few other places  Fuzzing hit another invalid pointer dereference due to the lack of checking whether jffs2_prealloc_raw_node_refs() completed successfully. Subsequent logic implies that the node refs have been allocated.  Handle that. The code is ready for propagating the error upwards.  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600 Call Trace:  jffs2_mark_erased_block fs/jffs2/erase.c:460 [inline]  jffs2_erase_pending_blocks+0x688/0x1860 fs/jffs2/erase.c:118  jffs2_garbage_collect_pass+0x638/0x1a00 fs/jffs2/gc.c:253  jffs2_reserve_space+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167  jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362  jffs2_write_end+0x712/0x1110 fs/jffs2/file.c:302  generic_perform_write+0x2c2/0x500 mm/filemap.c:3347  __generic_file_write_iter+0x252/0x610 mm/filemap.c:3465  generic_file_write_iter+0xdb/0x230 mm/filemap.c:3497  call_write_iter include/linux/fs.h:2039 [inline]  do_iter_readv_writev+0x46d/0x750 fs/read_write.c:740  do_iter_write+0x18c/0x710 fs/read_write.c:866  vfs_writev+0x1db/0x6a0 fs/read_write.c:939  do_pwritev fs/read_write.c:1036 [inline]  __do_sys_pwritev fs/read_write.c:1083 [inline]  __se_sys_pwritev fs/read_write.c:1078 [inline]  __x64_sys_pwritev+0x235/0x310 fs/read_write.c:1078  do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46  entry_SYSCALL_64_after_hwframe+0x67/0xd1  Found by Linux Verification Center (linuxtesting.org) with Syzkaller.","modified":"2026-09-01T16:06:14.219678597Z","published":"2025-07-10T09:15:27.067Z","upstream":["CVE-2025-38328"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38328"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.147-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38328.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38328.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.35-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38328.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}