Security readout for executives and security teams
Plain-English summary
A Linux F2FS filesystem bug can cause the kernel to reuse memory after it has been freed. A successful trigger could crash the system or potentially compromise confidentiality and integrity. The supplied CVSS score is 7.8, but the attack is local rather than network-based.
Executive priority
Treat as a prompt patching priority for multi-user, hosted, or otherwise untrusted systems using F2FS. For systems without F2FS use, verify configuration and track through routine kernel maintenance. Escalate if local users or workloads cannot be trusted.
Technical view
Syzbot and KASAN detected a use-after-free during F2FS inode writeback. The trace reaches list deletion through f2fs_inode_synced() while updating inode metadata. Linux stable commits correct the synchronization and list handling. The supplied vector requires local access, low privileges, low complexity, and no user interaction.
Likely exposure
Exposure is limited to systems running an affected Linux kernel where F2FS is present and used. Internet reachability alone does not create exposure. The supplied affected-version data is ambiguous, so kernel builds should be checked against vendor advisories or the referenced stable fixes rather than version strings alone.
Exploitation context
The issue was found through automated kernel testing. KEV is false, and the supplied sources provide no evidence of active exploitation or a public weaponized exploit. CVSS describes a local, low-privilege path with potentially high confidentiality, integrity, and availability impact.
Researcher notes
The evidence demonstrates a KASAN-detected use-after-free on a syzkaller Linux 6.1.129 build during writeback. Stable fixes exist across several kernel branches. The bundle does not establish practical privilege escalation, reliable exploitation, active attacks, or a temporary workaround; affected-range interpretation should follow distribution guidance.
Mitigation direction
- Install a vendor-supported kernel containing the applicable Linux stable fix.
- Prioritize systems that mount or actively use F2FS filesystems.
- If upgrades are delayed, consult the Linux distribution vendor for supported temporary guidance.
- Reboot into the updated kernel after following normal change-control procedures.
Validation and detection
- Inventory kernel builds and determine which systems mount or use F2FS.
- Check vendor advisories or changelogs for CVE-2025-38578 coverage.
- Confirm the running kernel incorporates the applicable referenced stable commit.
- After updating, verify systems booted into the corrected kernel and F2FS workloads remain healthy.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38578 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/37e78cad7e9e025e63bb35bc200f44637b009bb1CVE reference, Linux
- https://git.kernel.org/stable/c/4dcd830c420f2190ae32f03626039fde7b57b2adCVE reference, Linux
- https://git.kernel.org/stable/c/1edf68272b8cba2b2817ef1488ecb9f0f84cb6a0CVE reference, Linux
- https://git.kernel.org/stable/c/917ae5e280bc263f56c83fba0d0f0be2c4828083CVE reference, Linux
- https://git.kernel.org/stable/c/3d37cadaac1a8e108e576297aab9125b24ea2dfeCVE reference, Linux
- https://git.kernel.org/stable/c/dea243f58a8391e76f42ad5eb59ff210519ee772CVE reference, Linux
- https://git.kernel.org/stable/c/a4b0cc9e0bba7525a29f37714e88df12a47997a2CVE reference, Linux
- https://git.kernel.org/stable/c/6cac47af39b2b8edbb41d47c3bd9c332f83e9932CVE reference, Linux
- https://git.kernel.org/stable/c/7c30d79930132466f5be7d0b57add14d1a016bdaCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.