In the Linux kernel, the following vulnerability has been resolved:
erofs: avoid using multiple devices with different type
For multiple devices, both primary and extra devices should be the
same type. `erofs_init_device` has already guaranteed that if the
primary is a file-backed device, extra devices should also be
regular files.
However, if the primary is a block device while the extra device
is a file-backed device, `erofs_init_device` will get an ENOTBLK,
which is not treated as an error in `erofs_fc_get_tree`, and that
leads to an UAF:
erofs_fc_get_tree
get_tree_bdev_flags(erofs_fc_fill_super)
erofs_read_superblock
erofs_init_device // sbi->dif0 is not inited yet,
// return -ENOTBLK
deactivate_locked_super
free(sbi)
if (err is -ENOTBLK)
sbi->dif0.file = filp_open() // sbi UAF
So if -ENOTBLK is hitted in `erofs_init_device`, it means the
primary device must be a block device, and the extra device
is not a block device. The error can be converted to -EINVAL.
References
Configurations
Configuration 1 (hide)
|
History
20 Nov 2025, 19:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-416 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/65115472f741ca000d7ea4a5922214f93cd1516e - Patch | |
| References | () https://git.kernel.org/stable/c/9748f2f54f66743ac77275c34886a9f890e18409 - Patch | |
| References | () https://git.kernel.org/stable/c/cd04beb9ce2773a16057248bb4fa424068ae3807 - Patch |
Information
Published : 2025-07-03 09:15
Updated : 2025-11-20 19:22
NVD link : CVE-2025-38172
Mitre link : CVE-2025-38172
CVE.ORG link : CVE-2025-38172
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free