Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2025-38578— f2fs: fix to avoid UAF in f2fs_sync_inode_meta()

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于f2fs_sync_inode_meta函数中存在释放后重用，可能导致崩溃。

CVSS 7.8 · High EPSS 0.18% · P7 Updated Aug 05, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 20

Vendor	Product	Version Range	Status
Linux	Linux	`0f18b462b2e5aff64b8638e8a47284b907351ef3< 37e78cad7e9e025e63bb35bc200f44637b009bb1`	affected
		`0f18b462b2e5aff64b8638e8a47284b907351ef3< 4dcd830c420f2190ae32f03626039fde7b57b2ad`	affected
		`0f18b462b2e5aff64b8638e8a47284b907351ef3< 1edf68272b8cba2b2817ef1488ecb9f0f84cb6a0`	affected
		`0f18b462b2e5aff64b8638e8a47284b907351ef3< 917ae5e280bc263f56c83fba0d0f0be2c4828083`	affected
		`0f18b462b2e5aff64b8638e8a47284b907351ef3< 3d37cadaac1a8e108e576297aab9125b24ea2dfe`	affected
		`0f18b462b2e5aff64b8638e8a47284b907351ef3< dea243f58a8391e76f42ad5eb59ff210519ee772`	affected
		`0f18b462b2e5aff64b8638e8a47284b907351ef3< a4b0cc9e0bba7525a29f37714e88df12a47997a2`	affected
		`0f18b462b2e5aff64b8638e8a47284b907351ef3< 6cac47af39b2b8edbb41d47c3bd9c332f83e9932`	affected
… +12 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38578

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

f2fs: fix to avoid UAF in f2fs_sync_inode_meta()

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_sync_inode_meta() syzbot reported an UAF issue as below: [1] [2] [1] https://syzkaller.appspot.com/text?tag=CrashReport&x=16594c60580000 ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 Read of size 8 at addr ffff888100567dc8 by task kworker/u4:0/8 CPU: 1 PID: 8 Comm: kworker/u4:0 Tainted: G W 6.1.129-syzkaller-00017-g642656a36791 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x158/0x4e0 mm/kasan/report.c:427 kasan_report+0x13c/0x170 mm/kasan/report.c:531 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:351 __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 __list_del_entry include/linux/list.h:134 [inline] list_del_init include/linux/list.h:206 [inline] f2fs_inode_synced+0x100/0x2e0 fs/f2fs/super.c:1553 f2fs_update_inode+0x72/0x1c40 fs/f2fs/inode.c:588 f2fs_update_inode_page+0x135/0x170 fs/f2fs/inode.c:706 f2fs_write_inode+0x416/0x790 fs/f2fs/inode.c:734 write_inode fs/fs-writeback.c:1460 [inline] __writeback_single_inode+0x4cf/0xb80 fs/fs-writeback.c:1677 writeback_sb_inodes+0xb32/0x1910 fs/fs-writeback.c:1903 __writeback_inodes_wb+0x118/0x3f0 fs/fs-writeback.c:1974 wb_writeback+0x3da/0xa00 fs/fs-writeback.c:2081 wb_check_background_flush fs/fs-writeback.c:2151 [inline] wb_do_writeback fs/fs-writeback.c:2239 [inline] wb_workfn+0xbba/0x1030 fs/fs-writeback.c:2266 process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299 worker_thread+0xa60/0x1260 kernel/workqueue.c:2446 kthread+0x26d/0x300 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 </TASK> Allocated by task 298: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:333 kasan_slab_alloc include/linux/kasan.h:202 [inline] slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:768 slab_alloc_node mm/slub.c:3421 [inline] slab_alloc mm/slub.c:3431 [inline] __kmem_cache_alloc_lru mm/slub.c:3438 [inline] kmem_cache_alloc_lru+0x102/0x270 mm/slub.c:3454 alloc_inode_sb include/linux/fs.h:3255 [inline] f2fs_alloc_inode+0x2d/0x350 fs/f2fs/super.c:1437 alloc_inode fs/inode.c:261 [inline] iget_locked+0x18c/0x7e0 fs/inode.c:1373 f2fs_iget+0x55/0x4ca0 fs/f2fs/inode.c:486 f2fs_lookup+0x3c1/0xb50 fs/f2fs/namei.c:484 __lookup_slow+0x2b9/0x3e0 fs/namei.c:1689 lookup_slow+0x5a/0x80 fs/namei.c:1706 walk_component+0x2e7/0x410 fs/namei.c:1997 lookup_last fs/namei.c:2454 [inline] path_lookupat+0x16d/0x450 fs/namei.c:2478 filename_lookup+0x251/0x600 fs/namei.c:2507 vfs_statx+0x107/0x4b0 fs/stat.c:229 vfs_fstatat fs/stat.c:267 [inline] vfs_lstat include/linux/fs.h:3434 [inline] __do_sys_newlstat fs/stat.c:423 [inline] __se_sys_newlstat+0xda/0x7c0 fs/stat.c:417 __x64_sys_newlstat+0x5b/0x70 fs/stat.c:417 x64_sys_call+0x52/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:7 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 0: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x131/0x180 mm/kasan/common.c:241 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:249 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1745 [inline] slab_free_freelist_hook mm/slub.c:1771 [inline] slab_free mm/slub.c:3686 [inline] kmem_cache_free+0x ---truncated---

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	0f18b462b2e5aff64b8638e8a47284b907351ef3 ~ 37e78cad7e9e025e63bb35bc200f44637b009bb1	-
Linux	Linux	4.8	-

II. Public POCs for CVE-2025-38578

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2025-38578

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2025-38578

Same Patch Batch · Linux · 2025-08-19 · 59 CVEs total

CVE-2025-38561	9.8 CRITICAL	ksmbd: fix Preauh_HashValue race condition
CVE-2025-38566	9.8 CRITICAL	sunrpc: fix handling of server side tls alerts
CVE-2025-38560	9.3 CRITICAL	x86/sev: Evict cache lines during SNP memory validation
CVE-2025-38601	8.8 HIGH	wifi: ath11k: clear initialized flag for deinit-ed srng lists
CVE-2025-38600	8.8 HIGH	wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()
CVE-2025-38599	8.8 HIGH	wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx()
CVE-2025-38592	8.8 HIGH	Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv
CVE-2025-38608	8.6 HIGH	bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
CVE-2025-38574	8.6 HIGH	pptp: ensure minimal skb length in pptp_xmit()
CVE-2025-38571	8.2 HIGH	sunrpc: fix client side handling of tls alerts
CVE-2025-38595	7.8 HIGH	xen: fix UAF in dmabuf_exp_from_pages()
CVE-2025-38598	7.8 HIGH	drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0
CVE-2025-38607	7.8 HIGH	bpf: handle jset (if a & b ...) as a jump in CFG computation
CVE-2025-38614	7.8 HIGH	eventpoll: Fix semi-unbounded recursion
CVE-2025-38615	7.8 HIGH	fs/ntfs3: cancle set bad inode after removing name fails
CVE-2025-38604	7.8 HIGH	wifi: rtl818x: Kill URBs before clearing tx status queue
CVE-2025-38593	7.8 HIGH	Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
CVE-2025-38586	7.8 HIGH	bpf, arm64: Fix fp initialization for exception boundary
CVE-2025-38582	7.8 HIGH	RDMA/hns: Fix double destruction of rsv_qp
CVE-2025-38580	7.8 HIGH	ext4: fix inode use after free in ext4_end_io_rsv_work()

Showing top 20 of 59 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2025-38578

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-38578— f2fs: fix to avoid UAF in f2fs_sync_inode_meta()

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 20

I. Basic Information for CVE-2025-38578

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2025-38578

III. Intelligence Information for CVE-2025-38578

Same Patch Batch · Linux · 2025-08-19 · 59 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2025-38578

Leave a comment