CVE-2025-38627

What it actually does

Use-after-free in f2fs compression path where decompress_io_ctx holds a reference to f2fs_inode_info that can be freed via RCU after file unlink and before post_read_wq worker executes f2fs_free_dic, allowing dereference of freed inode fields such as i_compress_algorithm.

Why it matters to the business

Local attackers on Linux systems using f2fs with compression enabled can trigger kernel memory corruption, leading to crashes, privilege escalation, or arbitrary code execution; high workload systems increase exposure window and operational risk of denial of service.

How an attack unfolds

An attacker performs a concurrent read that triggers asynchronous decompression, immediately unlinks the file to queue inode eviction via RCU, then relies on the delayed post_read_wq worker to dereference the now-freed inode inside f2fs_free_dic, achieving UAF read or write.

How to fix it

Update Linux kernel to commit 5d604d40cd3232b09cb339941ef958e49283ed0a or later; for Chainguard packages update openjdk-17-openj9 and related variants to 0.53.0-r0 or newer; disable f2fs compression where not required as a temporary mitigation.

How to confirm the fix worked

Verify kernel source contains the stored compress_algorithm and sbi fields in decompress_io_ctx; confirm package versions match the listed fixed releases; test by exercising concurrent read+unlink workloads under load and checking for absence of UAF reports in dmesg or kmemleak.

Typical attack path

1. Open file on f2fs with compression enabled and issue read that schedules post_read_wq work
2. Immediately unlink or delete the file to trigger iput, evict, and call_rcu for inode freeing
3. Force high system load to delay kworker execution of f2fs_late_free_dic
4. RCU grace period expires and f2fs_free_inode releases the inode memory
5. Scheduled worker runs f2fs_free_dic and reads from now-freed inode structure

How to detect it

Monitor kernel logs for f2fs UAF warnings or oops involving f2fs_free_dic or f2fs_release_decomp_mem; inspect post_read_wq activity combined with rapid unlink operations on compressed f2fs files; review audit logs for sequences of read followed immediately by unlink under high CPU load.

What your security team should do

• Prioritize patching production systems using f2fs compression within 30 days given the local privilege-escalation potential
• Audit workloads for f2fs mount options with compression enabled and schedule upgrades using the exact fixed commits or package versions
• Add kernel memory-safety monitoring (e.g., KASAN) in test environments to validate the fix before rollout
• Consider filesystem migration or compression disablement for high-risk legacy kernels that cannot be updated promptly