CVE-2025-38627

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The Linux kernel contains a use-after-free (UAF) vulnerability within the f2fs file system compression functionality, specifically in the f2fs free dic function. The issue occurs when the decompress io ctx is released asynchronously after I/O completion. If a file is deleted immediately after being read, and the kworker processing the post-read work queue hasn't executed, the inode (f2fs inode info) can be freed before it's used in f2fs free dic. This can lead to a UAF condition where memory is accessed after being freed. The patch resolves this by storing the compress algorithm and sbi in the dic to prevent the inode UAF.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.