CVE-2025-38206

What it actually does

Double free of the vol_utbl pointer occurs when exfat_create_upcase_table returns an error, exfat_free_upcase_table is called, and then delayed_free invokes exfat_free_upcase_table again during exfat_kill_sb, resulting in use-after-free memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can achieve privilege escalation or trigger kernel crashes, disrupting operations on servers, containers, and embedded devices using exFAT; urgency is moderate given low EPSS and no KEV listing but high CVSS for local impact.

How an attack unfolds

An attacker with local access mounts a specially crafted exFAT volume that forces error paths in upcase table creation; this leaves a dangling pointer that delayed_free later frees a second time, corrupting kernel memory for code execution or denial of service. Related Linux kernel privilege-escalation techniques from similar CVEs may be adapted.

How to fix it

Upgrade Linux kernel to commit 13d8de1b6568dcc31a95534ced16bc0c9a67bc15 or later; for Chainguard packages update kubernetes-csi-external-snapshotter-fips-8.2 and kubernetes-csi-external-snapshot-controller-fips-8.2 to 8.2.1-r5 or newer; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel source contains the NULL assignment after free in exfat_free_upcase_table; confirm package versions match fixed releases; run kernel self-tests or mount exFAT volumes under error conditions to validate no double-free occurs.

Typical attack path

1. Obtain local user access on target Linux system
2. Prepare malicious exFAT image triggering upcase table allocation failure
3. Mount the image to invoke exfat_create_upcase_table error path
4. Trigger filesystem unmount or superblock kill to execute delayed_free
5. Exploit resulting double-free for memory corruption and privilege escalation

How to detect it

Review kernel logs for exfat upcase table allocation failures followed by delayed_free calls; inspect crash dumps for double-free signatures in exfat code paths; correlate with mount attempts of external exFAT media from untrusted sources.

What your security team should do

• Prioritize patching production kernels within 30 days given CVSS 7.8
• Monitor upstream stable branches for backports of the referenced commit
• Restrict untrusted exFAT mounts via mount options or SELinux policies until patched
• Audit container base images for affected kernel versions and rebuild
• Include this fix in next maintenance window for all Linux fleets