CVE-2025-38580Use After Free in Linux

CWE-416Use After Free5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 97.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 19

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode use after free in ext4_end_io_rsv_work() In ext4_io_end_defer_completion(), check if io_end->list_vec is empty to avoid adding an io_end that requires no conversion to the i_rsv_conversion_list, which in turn prevents starting an unnecessary worker. An ext4_emergency_state() check is also added to avoid attempting to abort the journal in an emergency state. Additionally, ext4_put_io_end_defer() is refactored t

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

NVDlinux/linux_kernel6.156.15.10+1
CVEListV5linux/linuxce51afb8cc5e1867ea0dfdf5e92ddbe31a1fad5dac999862b98a0f49e858e509f776be51406f1e77+3
debiandebian/linux

Patches

🔴Vulnerability Details

2
OSV
CVE-2025-38580: In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode use after free in ext4_end_io_rsv_work() In ext4_io_end_defer_comp2025-08-19
GHSA
GHSA-f7pq-5grc-hr54: In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode use after free in ext4_end_io_rsv_work() In ext4_io_end_defer_co2025-08-19

📋Vendor Advisories

2
Red Hat
kernel: ext4: fix inode use after free in ext4_end_io_rsv_work()2025-08-19
Debian
CVE-2025-38580: linux - In the Linux kernel, the following vulnerability has been resolved: ext4: fix i...2025
CVE-2025-38580 — Use After Free in Linux | cvebase