CVE-2025-37785: Linux Kernel Use-After-Free Vulnerability

CVE-2025-37785 Overview

CVE-2025-37785 is an out-of-bounds read vulnerability in the Linux kernel's ext4 filesystem implementation. The flaw occurs when mounting a corrupted filesystem containing a directory with a '.' (dot) entry where rec_len equals the block size. This condition causes the kernel to read memory beyond the allocated data block boundaries when the corrupted directory is removed, potentially leading to information disclosure or system crashes.

Critical Impact
A local attacker with low privileges can exploit this vulnerability by mounting a specially crafted corrupted ext4 filesystem, potentially causing kernel memory disclosure or denial of service through system crashes.

Affected Products

Linux Kernel (multiple versions)
Debian Linux (LTS releases)
Systems running ext4 filesystems

Discovery Timeline

April 18, 2025 - CVE-2025-37785 published to NVD
November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2025-37785

Vulnerability Analysis

The vulnerability resides in the ext4_empty_dir() function which assumes every ext4 directory contains at least '.' and '..' directory entries in the first data block. When processing directories, the function loads the '.' directory entry, performs sanity checks via ext4_check_dir_entry(), and then uses the rec_len member to compute the location of the '..' directory entry through ext4_next_entry.

The critical flaw occurs when the rec_len of '.' is precisely one block (4KB). In this scenario, the sanity checks pass because the entry is considered the last directory entry in the data block. However, this leaves the struct ext4_dir_entry_2 *de pointer pointing exactly past the allocated memory slot for the data block. The subsequent call to ext4_check_dir_entry() on this new value then dereferences the invalid pointer, resulting in out-of-bounds memory access.

This issue was discovered by the syzkaller kernel fuzzing tool. While KASAN reports it as a use-after-free when another structure was recently freed from the adjacent memory slot, the underlying issue is fundamentally an OOB read vulnerability.

Root Cause

The root cause is insufficient validation in the __ext4_check_dir_entry() function. The existing sanity checks fail to detect '.' directory entries that have a rec_len reaching exactly to the end of the data block. This oversight allows a malformed directory entry to pass validation while setting up conditions for an out-of-bounds memory access.

The fix extends __ext4_check_dir_entry() to specifically check for '.' directory entries that reach the end of the data block, while properly handling phony directory entries for checksum by checking name_len for non-zero values.

Attack Vector

The attack requires local access with low privileges. An attacker must be able to mount a specially crafted corrupted ext4 filesystem image. The exploitation path involves:

Creating or obtaining a corrupted ext4 filesystem image with a directory containing a '.' entry where rec_len equals the block size
Mounting this filesystem on a vulnerable system
Triggering directory removal operations (e.g., via rmdir) on the corrupted directory

The vulnerability is triggered during the ext4_rmdir operation when the kernel attempts to verify if the directory is empty. The call trace shows the exploitation path flows through ext4_rmdir → ext4_empty_dir → ext4_check_dir_entry, where the out-of-bounds read occurs at offset +0x67e.

Detection Methods for CVE-2025-37785

Indicators of Compromise

KASAN reports indicating slab-use-after-free or out-of-bounds read in __ext4_check_dir_entry()
Kernel crash dumps showing stack traces involving ext4_empty_dir and ext4_check_dir_entry functions
Unusual filesystem mount operations followed by directory removal commands
System instability when handling ext4 filesystem operations

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) to detect out-of-bounds memory accesses in kernel space
Monitor for kernel oops or panic messages containing references to ext4 directory entry functions
Implement filesystem integrity checking on mounted ext4 volumes before trusting directory structures
Deploy runtime integrity monitoring for kernel memory access patterns

Monitoring Recommendations

Configure kernel logging to capture ext4-related warnings and errors at increased verbosity
Set up alerts for KASAN violation reports in kernel ring buffer logs
Monitor system calls related to filesystem mounting and directory operations for anomalous patterns
Review audit logs for suspicious mount operations involving untrusted filesystem images

How to Mitigate CVE-2025-37785

Immediate Actions Required

Update the Linux kernel to a patched version that includes the fix for CVE-2025-37785
Restrict filesystem mount permissions to trusted users and processes only
Avoid mounting untrusted or unverified ext4 filesystem images
Enable KASAN in development and testing environments to detect similar memory safety issues

Patch Information

The Linux kernel developers have released patches addressing this vulnerability across multiple stable kernel branches. The fix extends the __ext4_check_dir_entry() function to properly validate '.' directory entries that reach the end of data blocks.

Official patches are available from the following kernel git commits:

Debian users should refer to the Debian LTS security announcements for distribution-specific updates.

Workarounds

Implement strict access controls on the mount system call to prevent unprivileged users from mounting arbitrary filesystems
Use filesystem scanning tools like e2fsck to validate ext4 filesystem integrity before mounting untrusted images
Consider using sandboxed environments or containers with restricted mount capabilities when handling potentially malicious filesystem images
Deploy mandatory access control policies (SELinux/AppArmor) to limit filesystem mount operations to authorized processes

bash

# Run filesystem check before mounting untrusted ext4 images
e2fsck -n /dev/sdX  # -n for read-only check
# Restrict mount capabilities using capabilities
setcap -r /bin/mount  # Remove capabilities if not needed
# Check current kernel version for vulnerability status
uname -r