Skip to main content

Linux CVE-2025-38627

HIGH
Use After Free (CWE-416)
2025-08-22 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux Use After Free Information Disclosure Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 25, 2026 - 11:22 vuln.today
Patch released
Mar 25, 2026 - 11:22 nvd
Patch available
CVE Published
Aug 22, 2025 - 16:15 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic

The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is used f2fs_free_dic.

The UAF case as below: Thread A Thread B

  • f2fs_decompress_end_io
  • f2fs_put_dic
  • queue_work

add free_dic work to post_read_wq

  • do_unlink
  • iput
  • evict
  • call_rcu

This file is deleted after read.

Thread C kworker to process post_read_wq

  • rcu_do_batch
  • f2fs_free_inode
  • kmem_cache_free

inode is freed by rcu

  • process_scheduled_works
  • f2fs_late_free_dic
  • f2fs_free_dic
  • f2fs_release_decomp_mem

read (dic->inode)->i_compress_algorithm

This patch store compress_algorithm and sbi in dic to avoid inode UAF.

In addition, the previous solution is deprecated in [1] may cause system hang. [1] https://lore.kernel.org/all/c36ab955-c8db-4a8b-a9d0-f07b5f426c3f@kernel.org

AnalysisAI

Use-after-free in the Linux kernel f2fs compression subsystem allows local authenticated attackers to achieve high confidentiality, integrity, and availability impact (CVSS 7.8). The vulnerability permits exploitation through a race condition where an inode can be freed while still referenced by asynchronous decompression work queues, leading to potential arbitrary code execution, information disclosure, or denial of service. With an EPSS score of 0.02% (5th percentile) and no public exploit identified at time of analysis, real-world exploitation risk remains relatively low despite the high severity score.

Technical ContextAI

The vulnerability resides in the F2FS (Flash-Friendly File System) compression functionality within the Linux kernel, specifically in the f2fs_free_dic (free decompression I/O context) code path. This is a CWE-416 use-after-free condition where the decompress_io_ctx structure may be released asynchronously after I/O completion via a workqueue (post_read_wq). A race window exists between file deletion triggering inode eviction through the RCU callback mechanism and the deferred execution of decompression cleanup work. When a compressed file is deleted immediately after read operations, the f2fs_inode_info structure can be freed by RCU garbage collection (kmem_cache_free) before the kworker thread processes the queued f2fs_late_free_dic work item. When f2fs_free_dic eventually executes and attempts to access dic->inode->i_compress_algorithm, it dereferences freed memory. The affected component is specific to systems utilizing F2FS with compression enabled, as indicated by the CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*.

RemediationAI

Apply vendor-released kernel patches available through official stable kernel trees. Patches are available at https://git.kernel.org/stable/c/39868685c2a94a70762bc6d77dc81d781d05bff5, https://git.kernel.org/stable/c/8fae5b6addd5f6895e03797b56e3c7b9f9cd15c9, https://git.kernel.org/stable/c/5d604d40cd3232b09cb339941ef958e49283ed0a, and https://git.kernel.org/stable/c/cc81768212cdc509e5a986274db7bc24d18cde19. Ubuntu users should follow guidance in security notices USN-8126-1 and USN-8125-1. The fix stores compress_algorithm and sbi directly in the decompression I/O context structure to eliminate the UAF condition by avoiding inode dereferencing during cleanup. Until patching is completed, system administrators using F2FS can consider temporarily disabling compression features if operationally feasible, though this may impact storage efficiency. Priority should be given to patching systems where untrusted local users have access or where F2FS compression is actively utilized.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2025-38627 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy