CVE-2025-38172

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A vulnerability has been resolved in the Linux kernel, specifically in the erofs module, where using multiple devices with different types could lead to a use-after-free (UAF) issue. This occurs when the primary device is a block device and the extra device is a file-backed device, causing erofs init device to return an ENOTBLK error, which is not treated as an error in erofs fc get tree. This can result in a UAF when sbi->dif0.file is assigned a value after sbi has been freed. The error can be converted to -EINVAL to prevent this issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.