CVE-2025-38627: f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
f2fs: compress: fix UAF of f2fsinodeinfo in f2fsfreedic
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (f2fs)to a version that resolves this vulnerability.Patch f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic - Configuration
Ensure the fix is implemented so that the free_dic work is queued to post_read_wq (instead of being released asynchronously such that inode can be evicted/RCU-freed before use), preventing use of read(dic->inode)->i_compress_algorithm after inode free.
F2FS post_read_wq (use free_dic work item scheduling) = add free_dic work to post_read_wq
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38627?
CVE-2025-38627 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38627?
To fix CVE-2025-38627, update your Linux kernel to the latest version that includes the security patch.
What does CVE-2025-38627 affect?
CVE-2025-38627 affects the f2fs file system in the Linux kernel where a use-after-free condition may occur.
What are the potential consequences of CVE-2025-38627?
The consequences of CVE-2025-38627 could include data corruption or a potential denial of service.
Is CVE-2025-38627 exploitable remotely?
CVE-2025-38627 is not considered a remote vulnerability as it requires local access to exploit.