CVE-2025-38172 erofs: avoid using multiple devices with different type
A use-after-free vulnerability in the Linux kernel's EROFS filesystem allows local attackers to potentially execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-38172?
CVE-2025-38172 is a high-severity use after free vulnerability in Linux kernel, published on 3 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
erofs: avoid using multiple devices with different type
For multiple devices, both primary and extra devices should be the same type. `erofs_init_device` has already guaranteed that if the primary is a file-backed device, extra devices should also be regular files.
However, if the primary is a block device while the extra device is a file-backed device, `erofs_init_device` will get an ENOTBLK, which is not treated as an error in `erofs_fc_get_tree`, and that leads to an UAF:
erofs_fc_get_tree get_tree_bdev_flags(erofs_fc_fill_super) erofs_read_superblock erofs_init_device // sbi->dif0 is not inited yet, // return -ENOTBLK deactivate_locked_super free(sbi) if (err is -ENOTBLK) sbi->dif0.file = filp_open() // sbi UAF
So if -ENOTBLK is hitted in `erofs_init_device`, it means the primary device must be a block device, and the extra device is not a block device. The error can be converted to -EINVAL.
Weakness: CWE-416
Which versions are affected by CVE-2025-38172?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38172?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-38172 being exploited?
There is no known exploitation of CVE-2025-38172 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38172, DEBIAN-CVE-2025-38172, GHSA-49r8-jp3j-22rh, UBUNTU-CVE-2025-38172.