PT-2025-34382 · Linux+1 · Linux Kernel+1

Published 2025-07-31 · Updated 2025-08-22 · CVE-2025-38620

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The Linux kernel contains a use-after-free issue within the zloop module. When a zoned loop device (zloop device) is removed, the blk mq free tag set() function accesses memory that has already been freed, leading to a kernel bug reported by KASAN (Kernel Address Sanitizer). Specifically, the zloop ctl remove() function calls put disk(), which then invokes zloop free disk(). zloop free disk() frees the memory associated with the zlo pointer. Subsequently, zloop ctl remove() calls blk mq free tag set(&zlo->tag set), attempting to access the freed zlo memory.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-02821

CVE-2025-38620

Affected Products

Astra Linux

Linux Kernel

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38620.json · Exploit
• https://git.kernel.org/stable/c/765761851d89c772f482494d452e266795460278 · Patch
• https://ubuntu.com/security/CVE-2025-38620 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-38620 · Security Note
• https://bdu.fstec.ru/vul/2026-02821 · Security Note
• https://git.kernel.org/stable/c/c7c87046b41a9ef28ee7ac476c369da5b5228bc5 · Patch
• https://osv.dev/vulnerability/CVE-2025-38620 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-38620 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38620 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/linus/765761851d89c772f482494d452e266795460278 · Note
• https://lore.kernel.org/linux-cve-announce/2025082229-CVE-2025-38620-1dc9@gregkh · Note
• https://twitter.com/CVEnew/status/1958933934533681202 · Twitter Post