CVE-2025-38627 in Linux
Summary
by MITRE • 08/22/2025
In the Linux kernel, the following vulnerability has been resolved:
f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic
The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is used f2fs_free_dic.
The UAF case as below: Thread A Thread B - f2fs_decompress_end_io - f2fs_put_dic - queue_work add free_dic work to post_read_wq - do_unlink - iput - evict - call_rcu This file is deleted after read.
Thread C kworker to process post_read_wq - rcu_do_batch - f2fs_free_inode - kmem_cache_free inode is freed by rcu - process_scheduled_works - f2fs_late_free_dic - f2fs_free_dic - f2fs_release_decomp_mem read (dic->inode)->i_compress_algorithm
This patch store compress_algorithm and sbi in dic to avoid inode UAF.
In addition, the previous solution is deprecated in [1] may cause system hang.
[1] https://lore.kernel.org/all/[email protected]
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/28/2026
The vulnerability CVE-2025-38627 represents a use-after-free condition in the Linux kernel's f2fs filesystem implementation that occurs during asynchronous decompression operations. This flaw specifically affects the f2fs_compress subsystem where decompression context structures are freed asynchronously after I/O completion. The issue manifests when a file is deleted immediately after being read, creating a race condition between the decompression worker thread and the inode eviction process. The vulnerability stems from the fact that the decompression context structure (decompr_io_ctx) may be released before all references to the associated inode are properly handled, leading to potential memory corruption and system instability.
The technical flaw occurs within the f2fs_free_dic function where the decompression context attempts to access inode information that has already been freed by the RCU (Read-Copy-Update) mechanism. The race condition develops when multiple threads operate concurrently on the same file system resources. Thread A handles the decompression completion and queues work to the post_read_wq workqueue, while Thread B performs the unlink operation that triggers inode eviction. The timing window between these operations allows for the inode to be freed by rcu_do_batch before the queued work in kworker processes the decompression cleanup, resulting in a use-after-free scenario. This particular vulnerability is classified under CWE-416 as Use After Free, which represents a critical memory safety issue in kernel space operations.
The operational impact of this vulnerability extends beyond simple memory corruption, potentially enabling privilege escalation and system crashes. When the f2fs_free_dic function attempts to access the freed inode structure, it may read invalid memory locations or corrupt kernel data structures, leading to unpredictable behavior. The system could experience kernel oops, system hangs, or even complete system crashes depending on the memory corruption patterns. Additionally, this vulnerability could be exploited by malicious actors to gain elevated privileges within the kernel space, as the use-after-free condition might allow for arbitrary code execution. The patch addresses this by storing the compression algorithm and superblock information directly within the decompression context structure rather than relying on potentially freed inode references, effectively preventing access to deallocated memory.
The mitigation strategy implemented in the patch involves modifying the decompression context management to preserve critical filesystem metadata before the inode is freed. This approach ensures that all necessary information for decompression cleanup operations remains accessible even after the inode structure has been evicted from memory. The solution specifically addresses the deprecated approach mentioned in the referenced kernel mailing list thread, which previously caused system hangs due to improper synchronization. The fix aligns with kernel security best practices for preventing use-after-free conditions in concurrent environments and demonstrates the importance of proper reference counting and memory lifecycle management in kernel subsystems. This vulnerability highlights the complexity of managing asynchronous operations in kernel space and the critical need for careful synchronization between different subsystems, particularly in high-concurrency scenarios involving file system operations and memory management. The patch represents a defensive programming approach that prevents access to freed memory structures while maintaining the functional integrity of the f2fs compression subsystem.