PT-2025-34389 · F2Fs+5 · F2Fs+5

Published 2025-01-01 · Updated 2026-05-07 · CVE-2025-38627

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The Linux kernel contains a use-after-free (UAF) vulnerability within the f2fs file system compression functionality, specifically in the f2fs free dic function. The issue occurs when the decompress io ctx is released asynchronously after I/O completion. If a file is deleted immediately after being read, and the kworker processing the post-read work queue hasn't executed, the inode (f2fs inode info) can be freed before it's used in f2fs free dic. This can lead to a UAF condition where memory is accessed after being freed. The patch resolves this by storing the compress algorithm and sbi in the dic to prevent the inode UAF.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

AZL-66602

BDU:2026-03074

CVE-2025-38627

ECHO-1FBA-C7F2-0F49

OESA-2026-1566

OESA-2026-1567

OESA-2026-1570

USN-8095-1

USN-8095-2

USN-8095-3

USN-8095-4

USN-8095-5

USN-8100-1

USN-8125-1

USN-8126-1

USN-8165-1

USN-8261-1

Affected Products

Astra Linux

Debian

Linuxmint

Linux Kernel

Ubuntu

F2Fs

References · 1491

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38627.json · Exploit
• https://ubuntu.com/security/CVE-2025-40219 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39911 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38524 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23268 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38693 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40006 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37842 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39931 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68282 · Security Note
• https://ubuntu.com/security/CVE-2025-39681 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39760 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71141 · Security Note
• https://ubuntu.com/security/CVE-2025-38579 · Vendor Advisory