jfs: fix slab-out-of-bounds read in ea_get()
In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the "size_check" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs "ea_get: invalid extended attribute" and calls print_hex_dump(). Here, EALIST_SIZE(ea_buf->xattr) returns 4110417968, which exceeds INT_MAX (2,147,483,647). Then ea_size is clamped: int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr)); Although clamp_t aims to bound ea_size between 0 and 4110417968, the upper limit is treated as an int, causing an overflow above 2^31 - 1. This leads "size" to wrap around and become negative (-184549328). The "size" is then passed to print_hex_dump() (called "len" in print_hex_dump()), it is passed as type size_t (an unsigned type), this is then stored inside a variable called "int remaining", which is then assigned to "int linelen" which is then passed to hex_dump_to_buffer(). In print_hex_dump() the for loop, iterates through 0 to len-1, where len is 18446744073525002176, calling hex_dump_to_buffer() on each iteration: for (i = 0; i < len; i += rowsize) { linelen = min(remaining, rowsize); remaining -= rowsize; hex_dump_to_buffer(ptr + i, linelen, rowsize, groupsize, linebuf, sizeof(linebuf), ascii); ... } The expected stopping condition (i < len) is effectively broken since len is corrupted and very large. This eventually leads to the "ptr+i" being passed to hex_dump_to_buffer() to get
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.236, 5.15.180, 5.4.292, 6.1.134, 6.12.23, 6.13.11, 6.14.2, 6.6.87
- CVEs
- CVE-2025-39735
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:27 UTC · Revision 1
Source evidence
jfs: fix slab-out-of-bounds read in ea_get()
core-osv · Original sourcePublished 18 Apr 2025, 07:01 UTC
In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the "size_check" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs "ea_get: invalid extended attribute" and calls print_hex_dump(). Here, EALIST_SIZE(ea_buf->xattr) returns 4110417968, which exceeds INT_MAX (2,147,483,647). Then ea_size is clamped: int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr)); Although clamp_t aims to bound ea_size between 0 and 4110417968, the upper limit is treated as an int, causing an overflow above 2^31 - 1. This leads "size" to wrap around and become negative (-184549328). The "size" is then passed to print_hex_dump() (called "len" in print_hex_dump()), it is passed as type size_t (an unsigned type), this is then stored inside a variable called "int remaining", which is then assigned to "int linelen" which is then passed to hex_dump_to_buffer(). In print_hex_dump() the for loop, iterates through 0 to len-1, where len is 18446744073525002176, calling hex_dump_to_buffer() on each iteration: for (i = 0; i < len; i += rowsize) { linelen = min(remaining, rowsize); remaining -= rowsize; hex_dump_to_buffer(ptr + i, linelen, rowsize, groupsize, linebuf, sizeof(linebuf), ascii); ... } The expected stopping condition (i < len) is effectively broken since len is corrupted and very large. This eventually leads to the "ptr+i" being passed to hex_dump_to_buffer() to get
osv:CVE-2025-39735
Kernel
Fixed versions: 5.4.292, 5.10.236, 5.15.180, 6.1.134, 6.6.87, 6.12.23, 6.13.11, 6.14.2
Complete source record
{
"id": "47c80fe6d8e84f5cbc2094aa6dc9160c772e60788007894aff6b837487360646",
"url": "https://osv.dev/vulnerability/CVE-2025-39735",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "jfs: fix slab-out-of-bounds read in ea_get()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the \"size_check\" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs \"ea_get: invalid extended attribute\" and calls print_hex_dump(). Here, EALIST_SIZE(ea_buf->xattr) returns 4110417968, which exceeds INT_MAX (2,147,483,647). Then ea_size is clamped: int size = clamp_t(int, ea_size, 0, EALIST_SIZE(ea_buf->xattr)); Although clamp_t aims to bound ea_size between 0 and 4110417968, the upper limit is treated as an int, causing an overflow above 2^31 - 1. This leads \"size\" to wrap around and become negative (-184549328). The \"size\" is then passed to print_hex_dump() (called \"len\" in print_hex_dump()), it is passed as type size_t (an unsigned type), this is then stored inside a variable called \"int remaining\", which is then assigned to \"int linelen\" which is then passed to hex_dump_to_buffer(). In print_hex_dump() the for loop, iterates through 0 to len-1, where len is 18446744073525002176, calling hex_dump_to_buffer() on each iteration: for (i = 0; i < len; i += rowsize) { linelen = min(remaining, rowsize); remaining -= rowsize; hex_dump_to_buffer(ptr + i, linelen, rowsize, groupsize, linebuf, sizeof(linebuf), ascii); ... } The expected stopping condition (i < len) is effectively broken since len is corrupted and very large. This eventually leads to the \"ptr+i\" being passed to hex_dump_to_buffer() to get",
"evidence": "osv:CVE-2025-39735",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.292",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.236",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.180",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.134",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.87",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.23",
"evidence": "/affected/1/ranges"
},
{
"value": "6.13.11",
"evidence": "/affected/1/ranges"
},
{
"value": "6.14.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2025-39735",
"aliases": [
"CVE-2025-39735"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6e39b681d1eb16f408493bf5023788b57f68998c"
},
{
"fixed": "3d6fd5b9c6acbc005e53d0211c7381f566babec1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "bbf3f1fd8a0ac7df1db36a9b9e923041a14369f2"
},
{
"fixed": "50afcee7011155933d8d5e8832f52eeee018cfd3"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "27a93c45e16ac25a0e2b5e5668e2d1beca56a478"
},
{
"fixed": "78c9cbde8880ec02d864c166bcb4fe989ce1d95f"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "9c356fc32a4480a2c0e537a05f2a8617633ddad0"
},
{
"fixed": "46e2c031aa59ea65128991cbca474bd5c0c2ecdb"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "9353cdf28d4c5c0ff19c5df7fbf81ea774de43a4"
},
{
"fixed": "a8c31808925b11393a6601f534bb63bac5366bab"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8c505ebeed8045b488b2e60b516c752b851f8437"
},
{
"fixed": "0beddc2a3f9b9cf7d8887973041e36c2d0fa3652"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d9f9d96136cba8fedd647d2c024342ce090133c2"
},
{
"fixed": "16d3d36436492aa248b2d8045e75585ebcc2f34d"
},
{
"fixed": "5263822558a8a7c0d0248d5679c2dcf4d5cda61f"
},
{
"fixed": "fdf480da5837c23b146c4743c18de97202fcab37"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.287"
},
{
"fixed": "5.4.292"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.231"
},
{
"fixed": "5.10.236"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.174"
},
{
"fixed": "5.15.180"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.1.120"
},
{
"fixed": "6.1.134"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.64"
},
{
"fixed": "6.6.87"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.12.2"
},
{
"fixed": "6.12.23"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4.19.325"
},
{
"fixed": "4.20"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.11.11"
},
{
"fixed": "6.12"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4ea25fa8747fb8b1e5a11d87b852023ecf7ae420"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "676a787048aafd4d1b38a522b05a9cc77e1b0a33"
}
]
}
],
"versions": [
"v5.4.291",
"v5.4.290",
"v5.4.289",
"v5.4.288",
"v5.4.287",
"v5.10.235",
"v5.10.234",
"v5.10.233",
"v5.10.232",
"v5.10.231",
"v5.15.179",
"v5.15.178",
"v5.15.177",
"v5.15.176",
"v5.15.175",
"v5.15.174",
"v6.1.133",
"v6.1.132",
"v6.1.131",
"v6.1.130",
"v6.1.129",
"v6.1.128",
"v6.1.127",
"v6.1.126",
"v6.1.125",
"v6.1.124",
"v6.1.123",
"v6.1.122",
"v6.1.121",
"v6.1.120",
"v6.6.86",
"v6.6.85",
"v6.6.84",
"v6.6.83",
"v6.6.82",
"v6.6.81",
"v6.6.80",
"v6.6.79",
"v6.6.78",
"v6.6.77",
"v6.6.76",
"v6.6.75",
"v6.6.74",
"v6.6.73",
"v6.6.72",
"v6.6.71",
"v6.6.70",
"v6.6.69",
"v6.6.68",
"v6.6.67",
"v6.6.66",
"v6.6.65",
"v6.6.64",
"v6.12.22",
"v6.12.21",
"v6.12.20",
"v6.12.19",
"v6.12.18",
"v6.12.17",
"v6.12.16",
"v6.12.15",
"v6.12.14",
"v6.12.13",
"v6.12.12",
"v6.12.11",
"v6.12.10",
"v6.12.9",
"v6.12.8",
"v6.12.7",
"v6.12.6",
"v6.12.5",
"v6.12.4",
"v6.12.3",
"v6.12.2",
"v4.19.325",
"v6.11.11"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39735.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.292"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.236"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.180"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.134"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.87"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.23"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.13.11"
},
{
"fixed": "6.14.2"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39735.json"
}
}
],
"modified": "2026-10-28T02:30:35.810662881Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/0beddc2a3f9b9cf7d8887973041e36c2d0fa3652",
"https://git.kernel.org/stable/c/16d3d36436492aa248b2d8045e75585ebcc2f34d",
"https://git.kernel.org/stable/c/3d6fd5b9c6acbc005e53d0211c7381f566babec1",
"https://git.kernel.org/stable/c/46e2c031aa59ea65128991cbca474bd5c0c2ecdb",
"https://git.kernel.org/stable/c/50afcee7011155933d8d5e8832f52eeee018cfd3",
"https://git.kernel.org/stable/c/5263822558a8a7c0d0248d5679c2dcf4d5cda61f",
"https://git.kernel.org/stable/c/78c9cbde8880ec02d864c166bcb4fe989ce1d95f",
"https://git.kernel.org/stable/c/a8c31808925b11393a6601f534bb63bac5366bab",
"https://git.kernel.org/stable/c/fdf480da5837c23b146c4743c18de97202fcab37",
"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html",
"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39735.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-39735",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39735.json"
}
},
"related_cves": [
{
"value": "CVE-2025-39735",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 503101,
"published_at": "2025-04-18T07:01:36.453+00:00"
}