Medium 5.5Published Sep 19, 2025

CVE-2025-39842ocfs2: prevent release journal inode after journal shutdown

Updated under an hour ago (Oct 27, 2026, 9:23 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode(). ocfs2_dismount_volume()-> ocfs2_delete_osb()-> ocfs2_free_slot_info()-> __ocfs2_free_slot_info()-> evict()-> ocfs2_evict_inode()-> ocfs2_clear_inode()-> jbd2_journal_release_jbd_inode(osb->journal->j_journal, Adding osb->journal checks will prevent null-ptr-deref during the above execution path.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 before 42c415c53ad2065088cc411d08925effa5b3d255; from da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 before e9188f66e94955431ddbe2cd1cdf8ff2bb486abf; from da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 before f4a917e6cd6c798f7adf39907f117fc754db1283; from da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 before 85e66331b60601d903cceaf8c10a234db863cd78; from da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 before f46e8ef8bb7b452584f2e75337b619ac51a7cadf	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.16 before 6.1.151; from 6.2 before 6.6.105; from 6.7 before 6.12.46; from 6.13 before 6.16.6; 6.17; 6.17; 6.17; 6.17	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/42c415c53ad2065088cc411d08925effa5b3d255	patch
https://git.kernel.org/stable/c/e9188f66e94955431ddbe2cd1cdf8ff2bb486abf	patch
https://git.kernel.org/stable/c/f4a917e6cd6c798f7adf39907f117fc754db1283	patch
https://git.kernel.org/stable/c/85e66331b60601d903cceaf8c10a234db863cd78	patch
https://git.kernel.org/stable/c/f46e8ef8bb7b452584f2e75337b619ac51a7cadf	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	mailing-list, third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.