Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-66602.json
JSON Data
https://api.test.osv.dev/v1/vulns/AZL-66602
Upstream
Published
2025-08-22T16:15:36Z
Modified
2026-04-01T05:21:00.493917Z
Summary
CVE-2025-38627 affecting package kernel for versions less than 6.6.119.3-1
Details

In the Linux kernel, the following vulnerability has been resolved:

f2fs: compress: fix UAF of f2fsinodeinfo in f2fsfreedic

The decompressioctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing postreadwq has not been executed yet due to high workloads, It is possible that the inode(f2fsinodeinfo) is evicted and freed before it is used f2fsfreedic.

The UAF case as below:
Thread A                                      Thread B
- f2fs_decompress_end_io
 - f2fs_put_dic
  - queue_work
    add free_dic work to post_read_wq
                                               - do_unlink
                                                - iput
                                                 - evict
                                                  - call_rcu
This file is deleted after read.

Thread C                                 kworker to process post_read_wq
- rcu_do_batch
 - f2fs_free_inode
  - kmem_cache_free
 inode is freed by rcu
                                         - process_scheduled_works
                                          - f2fs_late_free_dic
                                           - f2fs_free_dic
                                            - f2fs_release_decomp_mem
                                  read (dic->inode)->i_compress_algorithm

This patch store compress_algorithm and sbi in dic to avoid inode UAF.

In addition, the previous solution is deprecated in [1] may cause system hang. [1] https://lore.kernel.org/all/c36ab955-c8db-4a8b-a9d0-f07b5f426c3f@kernel.org

References

Affected packages

Azure Linux:3 / kernel

Package

Name
kernel
Purl
pkg:rpm/azure-linux/kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.119.3-1

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-66602.json"