CVE-2025-37741 is a vulnerability identified in the Linux kernel's JFS (Journaled File System) implementation. The issue arises from improper handling of the nlink (link count) value of inodes read from disk, specifically when the nlink value is zero. The vulnerability is triggered during operations involving the JFS inode allocation and deallocation routines, particularly in the functions diFree, diAlloc, and related inode management code paths. The root cause is that when reading the metadata page (metapage) of a fixed disk inode in raw mode, corrupted data can cause the nlink value to be set to zero erroneously. This leads to a deadlock scenario due to recursive locking attempts on the same lock (im_aglock) within the JFS inode map code. The deadlock occurs because the system tries to free an inode with an invalid nlink value, causing nested lock acquisitions that the kernel's lock dependency checker flags as unsafe. The vulnerability is triggered by the ioctl call LOOP_SET_STATUS64 with an offset value that does not match the mounted loop device, invalidating the device mapping and contributing to the corrupted inode state. The deadlock manifests as a kernel hang or freeze, impacting system stability and availability. The issue was reported by syzbot, a kernel fuzzing tool, and affects Linux kernel versions prior to the fix applied around version 6.12.0-rc7. No known exploits are reported in the wild at this time, and no CVSS score has been assigned yet. The vulnerability requires local access to the system to trigger the ioctl call and manipulate the JFS filesystem state, indicating that exploitation is not trivial but possible in environments where JFS is used and loop devices are manipulated.

For European organizations, the impact of CVE-2025-37741 primarily concerns system availability and reliability. Organizations running Linux systems with JFS filesystems, especially those using loop devices (commonly for mounting disk images or container filesystems), could experience kernel deadlocks leading to system hangs or crashes. This can disrupt critical services, cause downtime, and potentially lead to data loss if systems become unresponsive during important operations. While the vulnerability does not directly expose confidentiality or integrity risks, the denial-of-service condition can affect business continuity. European sectors relying on Linux-based infrastructure for servers, embedded systems, or specialized storage solutions that utilize JFS might be particularly vulnerable. Since JFS is less common than other filesystems like ext4 or XFS, the overall exposure is limited but still significant in niche environments such as legacy systems or specialized appliances. The absence of known exploits reduces immediate risk, but the vulnerability's presence in the kernel means that any attacker with local access and the ability to manipulate loop devices could trigger system instability. This is especially relevant for multi-tenant environments, cloud providers, or organizations with less restrictive local user permissions.

1. Upgrade the Linux kernel to a version that includes the patch fixing CVE-2025-37741, ideally version 6.12.0-rc7 or later where the fix was introduced. 2. Avoid using the JFS filesystem where possible, especially for critical systems; consider migrating to more widely used and actively maintained filesystems like ext4 or XFS. 3. Restrict local user permissions to prevent unauthorized use of ioctl calls on loop devices, limiting the ability to trigger the vulnerability. 4. Implement monitoring for kernel deadlocks and system hangs to detect early signs of exploitation or instability related to this issue. 5. In environments where loop devices are heavily used (e.g., container hosts, virtual machines), apply strict access controls and audit usage to prevent malicious or accidental triggering of the vulnerability. 6. For legacy systems that cannot be upgraded immediately, consider disabling or limiting the use of loop devices or JFS mounts until patches can be applied. 7. Engage with Linux distribution vendors for backported patches if upgrading the kernel is not feasible in the short term.