Answer in brief
CVE-2025-38172 records a High severity (CVSS 7.8) vulnerability in erofs: avoid using multiple devices with different type. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=fb176750266a3d7f42ebdcf28e8ba40350b27847 <65115472f741ca000d7ea4a5922214f93cd1516e || >=fb176750266a3d7f42ebdcf28e8ba40350b27847 <cd04beb9ce2773a16057248bb4fa424068ae3807 || >=fb176750266a3d7f42ebdcf28e8ba40350b27847 <9748f2f54f66743ac77275c34886a9f890e18409 | 65115472f741ca000d7ea4a5922214f93cd1516e, cd04beb9ce2773a16057248bb4fa424068ae3807, 9748f2f54f66743ac77275c34886a9f890e18409 |
| Linux/Linuxgeneric | 6.12 | Not reported |
Published upstream
Jul 3, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple devices with different type For multiple devices, both primary and extra devices should be the same type. `erofs_init_device` has already guaranteed that if the primary is a file-backed device, extra devices should also be regular files. However, if the primary is a block device while the extra device is a file-backed device, `erofs_init_device` will get an ENOTBLK, which is not treated as an error in `erofs_fc_get_tree`, and that leads to an UAF: erofs_fc_get_tree get_tree_bdev_flags(erofs_fc_fill_super) erofs_read_superblock erofs_init_device // sbi->dif0 is not inited yet, // return -ENOTBLK deactivate_locked_super free(sbi) if (err is -ENOTBLK) sbi->dif0.file = filp_open() // sbi UAF So if -ENOTBLK is hitted in `erofs_init_device`, it means the primary device must be a block device, and the extra device is not a block device. The error can be converted to -EINVAL.
Quoted source text, attributed separately from HOL analysis.