UAF Vulnerability in Linux Kernel Affecting Multiple Device Types

CVE-2025-38172

What is CVE-2025-38172?

A vulnerability exists in the Linux kernel, specifically in the erofs file system, where the initialization process fails to correctly handle different device types. If a primary block device is paired with a file-backed extra device, it leads to a use-after-free condition due to improper error handling, resulting in potential data corruption or application crashes. The issue occurs during the device initialization where the error -ENOTBLK is not treated as an error, permitting further unsafe operations that can compromise system integrity.

References