CVE-2025-38204

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix array-index-out-of-bounds read in add_missing_indices

stbl is s8 but it must contain offsets into slot which can go from 0 to 127.

Added a bound check for that error and return -EIO if the check fails. Also make jfs_readdir return with error if add_missing_indices returns with an error.

This flaw presents minimal risk to Red Hat environments because the legacy JFS file system is not enabled or compiled in Red Hat Enterprise Linux kernels. In environments where JFS is active, an attacker with local privileges could mount a corrupted file system image to trigger an out-of-bounds memory read during directory operations, potentially resulting in a kernel crash or memory leakage. Because the relevant file system driver is omitted entirely from Red Hat Enterprise Linux builds, supported Red Hat products are not affected.