CVE-2025-38206 Overview
CVE-2025-38206 is a double free vulnerability in the Linux kernel's exFAT filesystem implementation. The flaw resides in the delayed_free() code path and is triggered when exfat_create_upcase_table() fails and exfat_load_default_upcase_table() also returns an error. In that failure sequence, exfat_free_upcase_table() releases ->vol_utbl a first time, then exfat_kill_sb() invokes delayed_free() which calls exfat_free_upcase_table() again, resulting in a double free of the same allocation. The issue is classified under [CWE-415] (Double Free) and affects the mainline Linux kernel and Debian Linux distributions shipping the vulnerable exFAT driver.
Critical Impact
A local attacker able to mount a crafted exFAT filesystem can trigger kernel heap corruption, leading to denial of service or potential local privilege escalation.
Affected Products
- Linux Kernel (mainline branches prior to the fix commits)
- Debian Linux 11.0
- Distributions repackaging the vulnerable exFAT driver
Discovery Timeline
- 2025-07-04 - CVE-2025-38206 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-38206
Vulnerability Analysis
The vulnerability affects the exFAT filesystem driver in the Linux kernel. During mount initialization, exfat_create_upcase_table() allocates and populates the volume upcase table stored at ->vol_utbl. When the primary table creation fails, the error handling path calls exfat_free_upcase_table() to release the partially initialized structure. The kernel then falls back to exfat_load_default_upcase_table(). If this fallback also returns an error, the superblock teardown path executes exfat_kill_sb(), which schedules delayed_free(). That deferred routine calls exfat_free_upcase_table() a second time on the already-freed ->vol_utbl pointer.
Double free conditions in kernel context can corrupt slab allocator metadata, cause use-after-free on the freed chunk, or enable controlled overlap of freed and reallocated objects. Exploitation typically requires shaping the slab to place attacker-controlled data at the reused address.
Root Cause
The root cause is missing pointer invalidation after the first free. exfat_free_upcase_table() releases the memory backing ->vol_utbl but does not set the pointer to NULL. The fix sets ->vol_utbl to NULL after freeing so that the subsequent delayed_free() call becomes a no-op instead of a duplicate release.
Attack Vector
The attack vector is local. An attacker requires the ability to mount an exFAT filesystem or trigger the failing initialization sequence. The vulnerability produces high impact to confidentiality, integrity, and availability once triggered. On systems where non-privileged users can attach removable media that auto-mounts exFAT volumes, the attack surface extends beyond privileged accounts. See the Debian LTS Announcement and the upstream fix in the Kernel Commit Update for technical details.
Detection Methods for CVE-2025-38206
Indicators of Compromise
- Kernel oops or panic messages referencing exfat_free_upcase_table, delayed_free, or slab corruption warnings such as kernel BUG at mm/slub.c.
- Repeated exFAT mount failures followed by kernel warnings in dmesg or /var/log/kern.log.
- Unexpected mounts of exFAT volumes from removable media on servers that do not normally use exFAT.
Detection Strategies
- Audit kernel version inventory against the fixed commits (13d8de1b6568, 1f3d9724e16d, 66e84439ec2a, d3cef0e7a5c1) to identify unpatched hosts.
- Monitor mount and udev events for exFAT filesystems attached by non-administrative users.
- Alert on kernel ring buffer entries containing exfat alongside slab or KASAN diagnostics.
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and create rules for exFAT-related crash signatures.
- Track process and device telemetry for USB or loopback mount operations that precede kernel instability.
- Correlate reboot events with prior exFAT mount attempts to detect exploitation attempts causing denial of service.
How to Mitigate CVE-2025-38206
Immediate Actions Required
- Apply the upstream stable kernel updates that include the fix commits referenced by kernel.org.
- Update Debian systems using the packages listed in the Debian LTS advisory for the affected release.
- Restrict mounting of removable media and disable automatic mounting of exFAT volumes for non-administrative users.
Patch Information
The fix sets ->vol_utbl to NULL after the first call to exfat_free_upcase_table(), preventing the deferred delayed_free() handler from operating on an already-released pointer. Patched revisions are available through the Kernel Commit Update and companion stable backports at commit 66e84439 and commit d3cef0e7. Debian users should track the Debian LTS Announcement for distribution-specific package versions.
Workarounds
- Blacklist the exfat kernel module on systems that do not require exFAT support using /etc/modprobe.d/.
- Configure udev and polkit rules to prevent unprivileged users from mounting exFAT filesystems.
- Disable auto-mount features in desktop environments and file managers until patches are applied.
# Disable the exfat module on systems that do not need it
echo "blacklist exfat" | sudo tee /etc/modprobe.d/disable-exfat.conf
sudo depmod -a
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
