CVE-2025-38172

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38172", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.991Z", "datePublished": "2025-07-03T08:36:10.334Z", "dateUpdated": "2026-08-05T12:00:03.095Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:00:03.095Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: avoid using multiple devices with different type\n\nFor multiple devices, both primary and extra devices should be the\nsame type. `erofs_init_device` has already guaranteed that if the\nprimary is a file-backed device, extra devices should also be\nregular files.\n\nHowever, if the primary is a block device while the extra device\nis a file-backed device, `erofs_init_device` will get an ENOTBLK,\nwhich is not treated as an error in `erofs_fc_get_tree`, and that\nleads to an UAF:\n\n erofs_fc_get_tree\n get_tree_bdev_flags(erofs_fc_fill_super)\n erofs_read_superblock\n erofs_init_device // sbi->dif0 is not inited yet,\n // return -ENOTBLK\n deactivate_locked_super\n free(sbi)\n if (err is -ENOTBLK)\n sbi->dif0.file = filp_open() // sbi UAF\n\nSo if -ENOTBLK is hitted in `erofs_init_device`, it means the\nprimary device must be a block device, and the extra device\nis not a block device. The error can be converted to -EINVAL."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through the local mount(2)/fsconfig(2)+fsmount(2) filesystem-mount path on an erofs image plus its `device=` parameters; there is no network-facing consumer of this code.\nAC:L - The trigger is fully deterministic \u2014 an erofs image whose on-disk device table count matches the supplied `device=` options, with one such path naming a regular file instead of a block device, reliably yields -ENOTBLK and the use-after-free write on every attempt. Heap reuse of the freed `erofs_sb_info` is attacker-assisted because the free\u2192write window spans an attacker-influenceable `filp_open()` path walk that can be stalled arbitrarily, and the spray runs from the attacker's own threads.\nPR:N - The attacker needs no account or capability on the target: they only supply the malicious erofs image and/or arrange the `device=` path (which is resolved with symlink following at fill_super time, in directories such as container blob/staging dirs) to be a non-block file, while a privileged mounter \u2014 automounter, container/composefs runtime, or mount helper handling multi-device erofs images \u2014 performs the mount. This matches the kernel CNA treatment of crafted-image mount bugs (e.g. CVE-2025-38204, CVE-2025-38230, CVE-2025-38652).\nUI:R - The flaw only fires when someone mounts the attacker-supplied erofs image with the corresponding `device=` parameters; it cannot be triggered without that mount action.\nS:U - The freed object, the corrupted slab memory, and the resulting crash or escalation are all inside the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `file_inode(sbi->dif0.file)->i_mode` is read back out of the freed `erofs_sb_info`; if a sprayed object has taken the slot the kernel dereferences an attacker-groomed pointer and reads memory at an attacker-chosen location, and use-after-free of a kmalloc object is generally leverageable into kernel-memory disclosure.\nI:H - `sbi->dif0.file = file` writes a valid kernel `struct file *` at a fixed offset (16) into a freed generic-kmalloc chunk, clobbering whatever live object has been reallocated there \u2014 a classic UAF write primitive that overwrites pointers/state of an unrelated kernel object and is a strong stepping stone to control-flow hijacking.\nA:H - Even without grooming, the UAF read of poisoned/reused memory and the follow-on `get_tree_nodev()` path (which calls `erofs_fc_fill_super()` with `s_fs_info == NULL`, immediately writing through a NULL `sbi`) produce a kernel oops/panic, and the path also leaks a `struct file` reference on every attempt."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/super.c"], "versions": [{"version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "lessThan": "65115472f741ca000d7ea4a5922214f93cd1516e", "status": "affected", "versionType": "git"}, {"version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "lessThan": "cd04beb9ce2773a16057248bb4fa424068ae3807", "status": "affected", "versionType": "git"}, {"version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "lessThan": "9748f2f54f66743ac77275c34886a9f890e18409", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/super.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.34", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/65115472f741ca000d7ea4a5922214f93cd1516e"}, {"url": "https://git.kernel.org/stable/c/cd04beb9ce2773a16057248bb4fa424068ae3807"}, {"url": "https://git.kernel.org/stable/c/9748f2f54f66743ac77275c34886a9f890e18409"}], "title": "erofs: avoid using multiple devices with different type", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/erofs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "65115472f741ca000d7ea4a5922214f93cd1516e", "status": "affected", "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "versionType": "git"}, {"lessThan": "cd04beb9ce2773a16057248bb4fa424068ae3807", "status": "affected", "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "versionType": "git"}, {"lessThan": "9748f2f54f66743ac77275c34886a9f890e18409", "status": "affected", "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/erofs/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.34", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D349613A-2E37-4539-B97E-D97F5D92A03C", "versionEndExcluding": "6.12.34", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: avoid using multiple devices with different type\n\nFor multiple devices, both primary and extra devices should be the\nsame type. `erofs_init_device` has already guaranteed that if the\nprimary is a file-backed device, extra devices should also be\nregular files.\n\nHowever, if the primary is a block device while the extra device\nis a file-backed device, `erofs_init_device` will get an ENOTBLK,\nwhich is not treated as an error in `erofs_fc_get_tree`, and that\nleads to an UAF:\n\n erofs_fc_get_tree\n get_tree_bdev_flags(erofs_fc_fill_super)\n erofs_read_superblock\n erofs_init_device // sbi->dif0 is not inited yet,\n // return -ENOTBLK\n deactivate_locked_super\n free(sbi)\n if (err is -ENOTBLK)\n sbi->dif0.file = filp_open() // sbi UAF\n\nSo if -ENOTBLK is hitted in `erofs_init_device`, it means the\nprimary device must be a block device, and the extra device\nis not a block device. The error can be converted to -EINVAL."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: erofs: evitar el uso de m\u00faltiples dispositivos con diferentes tipos Para m\u00faltiples dispositivos, tanto los dispositivos principales como los adicionales deben ser del mismo tipo. `erofs_init_device` ya ha garantizado que si el principal es un dispositivo respaldado por archivos, los dispositivos adicionales tambi\u00e9n deben ser archivos normales. Sin embargo, si el dispositivo principal es un dispositivo de bloque mientras que el dispositivo adicional es un dispositivo respaldado por archivo, `erofs_init_device` obtendr\u00e1 un ENOTBLK, que no se trata como un error en `erofs_fc_get_tree`, y eso lleva a un UAF: erofs_fc_get_tree get_tree_bdev_flags(erofs_fc_fill_super) erofs_read_superblock erofs_init_device // sbi->dif0 a\u00fan no se ha inicializado, // return -ENOTBLK deactivate_locked_super free(sbi) if (err is -ENOTBLK) sbi->dif0.file = filp_open() // sbi UAF Entonces, si se alcanza -ENOTBLK en `erofs_init_device`, significa que el dispositivo principal debe ser un dispositivo de bloque y el dispositivo adicional no es un dispositivo de bloque. El error se puede convertir a -EINVAL."}], "id": "CVE-2025-38172", "lastModified": "2026-07-30T06:22:56.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-03T09:15:32.910", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/65115472f741ca000d7ea4a5922214f93cd1516e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9748f2f54f66743ac77275c34886a9f890e18409"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cd04beb9ce2773a16057248bb4fa424068ae3807"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: erofs: avoid using multiple devices with different type", "id": "2376072", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376072"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nerofs: avoid using multiple devices with different type\nFor multiple devices, both primary and extra devices should be the\nsame type. `erofs_init_device` has already guaranteed that if the\nprimary is a file-backed device, extra devices should also be\nregular files.\nHowever, if the primary is a block device while the extra device\nis a file-backed device, `erofs_init_device` will get an ENOTBLK,\nwhich is not treated as an error in `erofs_fc_get_tree`, and that\nleads to an UAF:\nerofs_fc_get_tree\nget_tree_bdev_flags(erofs_fc_fill_super)\nerofs_read_superblock\nerofs_init_device // sbi->dif0 is not inited yet,\n// return -ENOTBLK\ndeactivate_locked_super\nfree(sbi)\nif (err is -ENOTBLK)\nsbi->dif0.file = filp_open() // sbi UAF\nSo if -ENOTBLK is hitted in `erofs_init_device`, it means the\nprimary device must be a block device, and the extra device\nis not a block device. The error can be converted to -EINVAL."], "name": "CVE-2025-38172", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38172\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38172\nhttps://lore.kernel.org/linux-cve-announce/2025070343-CVE-2025-38172-13be@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-06T22:16:22.083724+00:00", "updated": "2025-07-06T22:16:22.083785+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}