CVE-2025-38627
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is used f2fs_free_dic. The UAF case as below: Thread A Thread B - f2fs_decompress_end_io - f2fs_put_dic - queue_work add free_dic work to post_read_wq - do_unlink - iput - evict - call_rcu This file is deleted after read. Thread C kworker to process post_read_wq - rcu_do_batch - f2fs_free_inode - kmem_cache_free inode is freed by rcu - process_scheduled_works - f2fs_late_free_dic - f2fs_free_dic - f2fs_release_decomp_mem read (dic->inode)->i_compress_algorithm This patch store compress_algorithm and sbi in dic to avoid inode UAF. In addition, the previous solution is deprecated in [1] may cause system hang. [1] https://lore.kernel.org/all/[email protected]
Analysis
Use-after-free in the Linux kernel f2fs compression subsystem allows local authenticated attackers to achieve high confidentiality, integrity, and availability impact (CVSS 7.8). The vulnerability permits exploitation through a race condition where an inode can be freed while still referenced by asynchronous decompression work queues, leading to potential arbitrary code execution, information disclosure, or denial of service. With an EPSS score of 0.02% (5th percentile) and no public exploit identified at time of analysis, real-world exploitation risk remains relatively low despite the high severity score.
Technical Context
The vulnerability resides in the F2FS (Flash-Friendly File System) compression functionality within the Linux kernel, specifically in the f2fs_free_dic (free decompression I/O context) code path. This is a CWE-416 use-after-free condition where the decompress_io_ctx structure may be released asynchronously after I/O completion via a workqueue (post_read_wq). A race window exists between file deletion triggering inode eviction through the RCU callback mechanism and the deferred execution of decompression cleanup work. When a compressed file is deleted immediately after read operations, the f2fs_inode_info structure can be freed by RCU garbage collection (kmem_cache_free) before the kworker thread processes the queued f2fs_late_free_dic work item. When f2fs_free_dic eventually executes and attempts to access dic->inode->i_compress_algorithm, it dereferences freed memory. The affected component is specific to systems utilizing F2FS with compression enabled, as indicated by the CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*.
Affected Products
Linux kernel versions are affected based on the F2FS compression feature availability, as confirmed by CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. Ubuntu has issued security advisories USN-8126-1 and USN-8125-1 (available at https://ubuntu.com/security/notices/USN-8126-1 and https://ubuntu.com/security/notices/USN-8125-1) indicating their distributions are impacted. The vulnerability affects kernel configurations where F2FS filesystem is compiled with compression support enabled. Specific vulnerable kernel version ranges are not explicitly detailed in the provided data, but patch commits reference multiple stable kernel branches requiring fixes, suggesting widespread impact across recent kernel versions utilizing F2FS compression.
Remediation
Apply vendor-released kernel patches available through official stable kernel trees. Patches are available at https://git.kernel.org/stable/c/39868685c2a94a70762bc6d77dc81d781d05bff5, https://git.kernel.org/stable/c/8fae5b6addd5f6895e03797b56e3c7b9f9cd15c9, https://git.kernel.org/stable/c/5d604d40cd3232b09cb339941ef958e49283ed0a, and https://git.kernel.org/stable/c/cc81768212cdc509e5a986274db7bc24d18cde19. Ubuntu users should follow guidance in security notices USN-8126-1 and USN-8125-1. The fix stores compress_algorithm and sbi directly in the decompression I/O context structure to eliminate the UAF condition by avoiding inode dereferencing during cleanup. Until patching is completed, system administrators using F2FS can consider temporarily disabling compression features if operationally feasible, though this may impact storage efficiency. Priority should be given to patching systems where untrusted local users have access or where F2FS compression is actively utilized.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today