Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s F2FS filesystem can trigger a use-after-free and kernel panic during inode cleanup. Successful abuse requires local, low-privilege access and an affected system using F2FS. The resulting business risk is primarily system disruption, although the supplied CVSS assessment also indicates potential confidentiality and integrity impact.
Executive priority
Treat as a high-priority operating-system update for systems using F2FS or hosting untrusted local users. Prioritize availability-sensitive infrastructure because the demonstrated outcome includes kernel panic. Broad emergency action across systems without F2FS is not supported by the supplied evidence.
Technical view
The F2FS inode eviction path can leave invalid list state, causing a use-after-free during inode synchronization and filesystem checkpoint or teardown. KASAN detected an invalid read in __list_del_entry_valid through f2fs_inode_synced. The supplied CVSS 3.1 score is 7.8 with local, low-complexity, low-privilege attack requirements.
Likely exposure
Exposure is limited to affected Linux kernels where F2FS is present and the vulnerable filesystem behavior is reachable by a local user or workload. Internet-facing services are not directly exposed solely by listening on a network. The supplied version data is complex, so confirm applicability through distribution advisories and kernel package changelogs.
Exploitation context
The issue was found by syzbot and reproduced with KASAN on a 6.1.129 test kernel. The bundle provides no evidence of real-world exploitation, and the CVE is not listed as KEV. Practical exploitation conditions beyond local low-privilege access and interaction with F2FS are not fully documented here.
Researcher notes
The reported path reaches __list_del_entry_valid from f2fs_inode_synced during inode update, writeback, checkpoint, and filesystem teardown. The concrete evidence demonstrates a use-after-free and panic. Although CVSS assigns high confidentiality, integrity, and availability impact, the bundle does not establish a public exploit or demonstrated privilege escalation.
Mitigation direction
- Install a vendor-supported kernel containing the referenced stable F2FS fix.
- Prioritize systems using F2FS or allowing untrusted local workloads.
- Follow Linux distribution advisories for exact fixed package versions.
- Restrict unnecessary local access until affected systems are updated.
- Reboot into the updated kernel after package installation.
Validation and detection
- Inventory running kernel versions and identify mounted or configured F2FS filesystems.
- Compare kernel packages against vendor advisories and referenced stable fixes.
- Confirm the updated kernel is running after reboot.
- Review kernel logs for KASAN reports, use-after-free messages, or F2FS-related panics.
- Verify scanners recognize the vendor backport, not only upstream version numbers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38577 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/15df59809c54fbd687cdf27efbd2103a937459beCVE reference, Linux
- https://git.kernel.org/stable/c/9535e440fe5bc6c5ac7cfb407e53bf788b8bf8d4CVE reference, Linux
- https://git.kernel.org/stable/c/5cd99d5aa3d39086bdb53eb5c52df16e98b101a0CVE reference, Linux
- https://git.kernel.org/stable/c/4732ca17c17f5062426cfa982f43593e6b81963bCVE reference, Linux
- https://git.kernel.org/stable/c/880ef748e78a1eb7df2d8e11a9ef21e98bcaabe5CVE reference, Linux
- https://git.kernel.org/stable/c/97df495d754116c8c28ac6a4112f831727bde887CVE reference, Linux
- https://git.kernel.org/stable/c/9bbfe83924946552c4c513099c0e8c83af76311aCVE reference, Linux
- https://git.kernel.org/stable/c/42f9ea16aea8b49febaa87950a006a1792209f38CVE reference, Linux
- https://git.kernel.org/stable/c/a509a55f8eecc8970b3980c6f06886bbff0e2f68CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.