CVE-2025-38627 f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
A use-after-free vulnerability in the Linux kernel's f2fs filesystem allows attackers to cause system crashes or potentially execute code via race conditions during file deletion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38627?
CVE-2025-38627 is a high-severity use after free vulnerability in Linux kernel, published on 22 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is used f2fs_free_dic.
The UAF case as below: Thread A Thread B - f2fs_decompress_end_io - f2fs_put_dic - queue_work add free_dic work to post_read_wq - do_unlink - iput - evict - call_rcu This file is deleted after read.
Thread C kworker to process post_read_wq - rcu_do_batch - f2fs_free_inode - kmem_cache_free inode is freed by rcu - process_scheduled_works - f2fs_late_free_dic - f2fs_free_dic - f2fs_release_decomp_mem read (dic->inode)->i_compress_algorithm
This patch store compress_algorithm and sbi in dic to avoid inode UAF.
In addition, the previous solution is deprecated in [1] may cause system hang. [1] https://lore.kernel.org/all/[email protected]
Weakness: CWE-416
Which versions are affected by CVE-2025-38627?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38627?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-38627 being exploited?
There is no known exploitation of CVE-2025-38627 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-66602, BELL-CVE-2025-38627, DEBIAN-CVE-2025-38627, GHSA-433r-68jw-r53j, ROOT-OS-DEBIAN-12-CVE-2025-38627, ROOT-OS-DEBIAN-13-CVE-2025-38627 and 2 more.