CVE-2025-37738: Linux Kernel Use-After-Free Vulnerability

CVE-2025-37738 Overview

CVE-2025-37738 is a use-after-free vulnerability [CWE-416] in the Linux kernel's ext4 filesystem. The flaw resides in the ext4_xattr_inode_dec_ref_all function, which fails to ignore extended attribute (xattr) entries past the end entry. A local attacker with low privileges can trigger out-of-bounds reads against freed slab memory by crafting a malicious ext4 filesystem image and performing an unlinkat syscall on an inode containing malformed xattrs. The issue was detected by Kernel Address Sanitizer (KASAN) and reproduced on Linux 6.13.0-rc2. Debian Linux 11 is also affected, with patches issued through Debian LTS announcements.

Critical Impact

Local low-privileged attackers can trigger kernel memory corruption in ext4 xattr handling, potentially leading to denial of service or local privilege escalation through use-after-free exploitation.

Affected Products

• Linux kernel (multiple stable branches, including 6.13.0-rc2 and earlier)
• Debian Linux 11
• Distributions shipping unpatched ext4 with the vulnerable ext4_xattr_inode_dec_ref_all code path

Discovery Timeline

• 2025-05-01 - CVE-2025-37738 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-37738

Vulnerability Analysis

The vulnerability exists in the ext4 extended attribute teardown path. When the kernel evicts an inode and calls ext4_xattr_delete_inode, it iterates over xattr entries to decrement reference counts on associated xattr inodes via ext4_xattr_inode_dec_ref_all. The iteration loop does not validate that the current entry pointer remains within the end boundary of the xattr block. A crafted ext4 image can place malformed xattr entries that cause the loop to read past valid memory, accessing freed struct file slab memory (cache filp, 360-byte region).

The KASAN report shows a slab-use-after-free read of size 4 at offset 196 inside a freed object. The call chain originates from do_unlinkat through evict and ext4_evict_inode, ultimately reaching the unbounded xattr iteration in ext4_xattr_inode_dec_ref_all.

Root Cause

The root cause is missing bounds checking inside the xattr iteration loop in ext4_xattr_inode_dec_ref_all. The function continues processing entries beyond the declared end pointer when xattr metadata is malformed. This permits the kernel to dereference attacker-influenced memory addresses that may correspond to freed slab objects, producing a use-after-free condition.

Attack Vector

Exploitation requires local access and the ability to mount or interact with a malicious ext4 filesystem image, or to manipulate xattrs on an existing filesystem in a way that bypasses validation. The attacker triggers an unlink operation on an inode with crafted xattrs. The resulting use-after-free read can be developed into an information leak or, with additional heap grooming, a write primitive enabling privilege escalation. The vulnerability does not require user interaction or network access.

No public proof-of-concept exploit is currently available. See the Linux kernel commit fix for the patch implementing the end boundary check.

Detection Methods for CVE-2025-37738

Indicators of Compromise

• KASAN reports referencing ext4_xattr_inode_dec_ref_all slab-use-after-free reads in kernel logs
• Unexpected kernel oopses or panics during unlinkat syscalls on ext4 volumes
• Mount events for untrusted or removable ext4 filesystem images by non-administrative users
• Repeated process crashes immediately following filesystem operations on suspicious inodes

Detection Strategies

• Enable KASAN on test or staging kernels to surface use-after-free triggers during filesystem fuzzing or regression testing
• Audit dmesg and /var/log/kern.log for stack traces containing ext4_xattr_inode_dec_ref_all or ext4_xattr_delete_inode
• Monitor auditd for mount syscalls referencing user-supplied filesystem images and correlate with subsequent kernel warnings

Monitoring Recommendations

• Forward kernel ring buffer events to a centralized logging platform and alert on KASAN, BUG, or Oops markers
• Track installed kernel package versions across the fleet and flag hosts running unpatched ext4 code
• Watch for non-root users invoking mount, unshare, or container runtimes that expose ext4 image mounting capabilities

How to Mitigate CVE-2025-37738

Immediate Actions Required

• Apply the upstream Linux kernel patches referenced in the kernel.org stable commits and reboot affected hosts
• Update Debian 11 systems per the Debian LTS announcement and the follow-up advisory
• Restrict unprivileged users from mounting arbitrary filesystem images by tightening CAP_SYS_ADMIN, user namespace, and FUSE/loop device permissions

Patch Information

The Linux kernel maintainers issued fixes across multiple stable branches. The corrective commits add bounds validation so that ext4_xattr_inode_dec_ref_all stops processing entries past the end marker. Refer to the upstream commits including 362a90cecd36, 3bc6317033f3, 6aff941cb0f7, 76c365fa7e2a, 836e625b03a6, c8e008b60492, cf9291a3449b, eb59cc31b6ea, and f737418b6de3 on git.kernel.org. Debian users should install the latest linux package from security updates.

Workarounds

• Disable automatic mounting of removable ext4 media for non-administrative accounts via udev and polkit policies
• Set kernel.unprivileged_userns_clone=0 to limit user namespace abuse that enables unprivileged filesystem mounting
• Avoid exposing loopback or FUSE mount capabilities to untrusted workloads and container tenants

# Configuration example: restrict unprivileged mounting and verify kernel version
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2025-37738.conf

# Debian: apply security updates
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)

# Verify running kernel after reboot
uname -r