CVE-2025-38620: zloop: fix KASAN use-after-free of tag set
In the Linux kernel, the following vulnerability has been resolved:
zloop: fix KASAN use-after-free of tag set
When a zoned loop device, or zloop device, is removed, KASAN enabled kernel reports "BUG KASAN use-after-free" in blkmqfreetagset(). The BUG happens because zloopctlremove() calls putdisk(), which invokes zloopfreedisk(). The zloopfreedisk() frees the memory allocated for the zlo pointer. However, after the memory is freed, zloopctlremove() calls blkmqfreetagset(&zlo->tagset), which accesses the freed zlo. Hence the KASAN use-after-free.
zloopctlremove() putdisk(zlo->disk) putdevice() kobjectput() ... zloopfreedisk() kvfree(zlo) blkmqfreetagset(&zlo->tagset)
To avoid the BUG, move the call to blkmqfreetagset(&zlo->tagset) from zloopctlremove() into zloopfreedisk(). This ensures that the tagset is freed before the call to kvfree(zlo).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38620?
CVE-2025-38620 is classified as a high severity vulnerability due to the potential for use-after-free errors in the Linux kernel affecting zloop devices.
How do I fix CVE-2025-38620?
To fix CVE-2025-38620, ensure that your Linux kernel is updated to the version that includes the patch addressing this vulnerability.
What type of vulnerability is CVE-2025-38620?
CVE-2025-38620 is a use-after-free vulnerability that occurs in the Linux kernel's management of zoned loop devices.
Who is affected by CVE-2025-38620?
CVE-2025-38620 affects users of the Linux kernel who utilize zoned loop devices, specifically those with KASAN enabled.
Is CVE-2025-38620 actively exploited?
As of now, there are no public reports indicating that CVE-2025-38620 is actively exploited in the wild.