Linux Kernel JFS EUVD-2025-209683

The primary fix is to upgrade to a patched Linux kernel version. Vendor-released patches are confirmed across stable series: upgrade to 5.10.252 or later, 5.15.202 or later, 6.1.165 or later, 6.6.128 or later, 6.12.75 or later, 6.18.16 or later, 6.19.6 or later, or 7.0 or later. Upstream fix commits are available at git.kernel.org/stable/c/ (see references: 2108829a, b4330a0d, a3d66089, f70fcbc2, 5d77c36c, fe136426, 93c32574, 9218dc26). For systems where kernel patching is not immediately feasible, a practical compensating control is to avoid mounting JFS filesystems accessible to untrusted low-privilege users - switching to ext4 or xfs for user-accessible volumes eliminates the attack surface entirely with no functional trade-off for most workloads. If JFS must be used, restricting filesystem access via Linux DAC permissions or mandatory access control (SELinux/AppArmor) policies to limit which users can perform rename operations in JFS directories reduces exploitability. Enabling kernel panic-on-warn in production should be reconsidered if not already disabled, as the drop_nlink warning could cause system halt depending on kernel build configuration.