CVE-2025-22036: Linux Kernel Use-After-Free Vulnerability

CVE-2025-22036 Overview

CVE-2025-22036 is a use-after-free vulnerability in the Linux kernel's exFAT file system implementation. The flaw arises from a race condition in exfat_get_block() when the function operates on a buffer_head allocated on the caller's stack, such as during do_mpage_readpage(). A concurrent thread can decrement the buffer's reference count after the stack frame goes out of scope, corrupting arbitrary stack memory. Successful exploitation can lead to kernel memory corruption, denial of service, or local privilege escalation on systems mounting exFAT volumes. The issue is classified under CWE-362 (race condition) and CWE-416 (use-after-free).

Critical Impact
Local attackers with the ability to trigger exFAT read operations can corrupt kernel stack memory, potentially escalating privileges or destabilizing the system.

Affected Products

Linux Kernel (mainline) prior to the patched commits
Stable trees containing the exFAT driver before backport
Distributions shipping vulnerable kernel versions with exFAT support enabled

Discovery Timeline

2025-04-16 - CVE-2025-22036 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-22036

Vulnerability Analysis

The vulnerability lives in the exFAT get_block path. When mpage_read_folio() calls do_mpage_readpage(), it declares a buffer_head on its own stack and passes it to exfat_get_block(). That function calls bh_read(), which invokes __bh_read() and increments the buffer reference via get_bh(bh) before submitting I/O with submit_bh() and waiting via wait_on_buffer().

On a second CPU, end_buffer_read_sync() completes and calls __end_buffer_read_notouch(), which unlocks the buffer and returns control to the original caller. The waiter proceeds, and the stack frame containing the buffer_head is torn down. The completion path then executes put_bh(bh), which performs atomic_dec(bh->b_count) against memory that now belongs to an unrelated stack frame, corrupting whatever local variable occupies that offset.

Root Cause

The root cause is a lifetime mismatch: bh_read() assumes it can hold a reference to the buffer_head beyond the synchronous wait, but the caller allocated the structure on the stack. The completion handler decrements the reference count after the caller has already unwound, producing a classic use-after-free that manifests as random stack corruption.

Attack Vector

Exploitation requires local access and the ability to trigger reads against an exFAT-formatted volume. An attacker who can mount or interact with an attacker-controlled exFAT image, such as via a USB device or a user-mountable loop file, can race the read path to corrupt kernel stack memory. The race is timing-dependent and difficult but not impossible to weaponize.

No public proof-of-concept exploit is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream patches at Linux Kernel Commit 1bb7ff4 and Linux Kernel Commit f807a6b for the technical fix.

Detection Methods for CVE-2025-22036

Indicators of Compromise

Unexplained kernel oops or panics referencing exfat_get_block, bh_read, or mpage_read_folio in dmesg output.
Random stack corruption warnings or KASAN reports flagging use-after-free in the exFAT read path.
System instability correlated with mounting or reading exFAT volumes, particularly from removable media.

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch use-after-free access against freed stack-based buffer_head structures.
Audit installed kernel versions against the fixed commits listed in the kernel.org stable tree to identify unpatched hosts.
Monitor for kernel crash telemetry that fingerprints the exFAT read stack trace across the fleet.

Monitoring Recommendations

Centralize journald and kdump output so kernel panics involving exfat symbols surface for triage.
Track USB storage insertion events and correlate them with subsequent kernel warnings.
Alert on repeated mount attempts of exFAT volumes by unprivileged users on multi-user systems.

How to Mitigate CVE-2025-22036

Immediate Actions Required

Apply the upstream kernel patches or vendor-provided updates that include the fix commits referenced by the Linux stable tree.
Restrict unprivileged users from mounting arbitrary block devices or loop-mounted exFAT images.
Disable automatic mounting of removable exFAT media on servers and sensitive workstations until patching is complete.

Patch Information

The fix returns -EAGAIN from exfat_get_block() when a folio does not have buffers, allowing the caller to fall back to block_read_full_folio(), allocate a proper heap-backed buffer, and retry. This eliminates the on-stack buffer_head from the bh_read() path. Fixes are available at Linux Kernel Commit 1bb7ff4, Linux Kernel Commit 49b0a6a, Linux Kernel Commit f744728, and Linux Kernel Commit f807a6b.

Workarounds

Unload or blacklist the exfat kernel module on systems that do not require exFAT support.
Enforce mount policies via udev rules or polkit to require administrative privilege for exFAT volumes.
Use MAC frameworks such as SELinux or AppArmor to restrict which processes can trigger reads against untrusted exFAT filesystems.

bash

# Blacklist the exfat module until the kernel is patched
echo "blacklist exfat" | sudo tee /etc/modprobe.d/disable-exfat.conf
sudo modprobe -r exfat

# Verify the running kernel version against fixed stable releases
uname -r