CVE-2025-39735

Summary

CVE-2025-39735 is a vulnerability affecting the Linux kernel's JFS filesystem. In the function ea_get(), the code intends to clamp the size of an extended attribute list, but the clamping operation results in an integer overflow. The overflow causes the variable "size" to become negative, which is later passed as the length parameter to print_hex_dump(). Since the stopping condition in the for loop of print_hex_dump() is based on the incorrect length value, it leads to an out-of-bounds access in the following for loop within print_hex_dump(). To mitigate this issue, it's essential to validate the size of the extended attribute list before it's utilized.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.