{"id":"ASB-A-499041514","details":"In multiple functions of compress.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-499041514","CVE-2025-38627"],"modified":"2026-11-05T16:32:28.703711716Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/84b5a9e56e50b8222cd5999cd8e44d0bdf7fed4f"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2026-11-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"severity":"High","spl":"2026-11-05","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"file":"fs/f2fs/compress.c","function":"f2fs_compress_write_end_io"},"deprecated":false,"digest":{"length":653,"function_hash":"55989782831528650047615861070583905681"},"id":"ASB-A-499041514-0a6df951","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"file":"fs/f2fs/compress.c","function":"f2fs_write_compressed_pages"},"deprecated":false,"digest":{"length":4838,"function_hash":"23911516186151812126285498025494064902"},"id":"ASB-A-499041514-16e61a7c"},{"source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"file":"fs/f2fs/compress.c","function":"f2fs_init_compress_ctx"},"deprecated":false,"digest":{"function_hash":"217992329313013624045017860555906211598","length":182},"id":"ASB-A-499041514-21919c62","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"file":"fs/f2fs/compress.c","function":"page_array_free"},"deprecated":false,"digest":{"function_hash":"89999943499741124249131594334031796243","length":309},"id":"ASB-A-499041514-299615ec","signature_type":"Function"},{"source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"function":"f2fs_write_compressed_pages","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"length":4548,"function_hash":"270266926901652386660951561374926219100"},"id":"ASB-A-499041514-2b927b89","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"function":"f2fs_free_dic","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"function_hash":"175260826828192608557161547606205714801","length":730},"id":"ASB-A-499041514-3df8e609"},{"digest":{"function_hash":"311872153156619657418855753991177303583","length":281},"id":"ASB-A-499041514-4c82007b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"file":"fs/f2fs/compress.c","function":"f2fs_destroy_compress_ctx"},"deprecated":false},{"id":"ASB-A-499041514-4f827997","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"file":"fs/f2fs/compress.c","function":"f2fs_prepare_decomp_mem"},"deprecated":false,"digest":{"function_hash":"251009063058845828252660541478974075106","length":851}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"line_hashes":["93460549504009682191912378729076492705","224997850459333721217930266823868768376","108394170236598334515011525127368199952","73407920136660074807641638594056349301","85259503849476585494467864802635604648","73960982417743782689057887345318705352","221187607062658494155917976150010871027","297865325927233622517502042533006007351","158060336519898321496091760771395137466","215902774869814679395835049662761056010","160787077589459841717200307841532377950","146545757902991409975762709052182917144","136361577883117483296541222324128330352","56774226496245608213720188899083780925","304540044565540693201118420261884696190","103922071390217792232731095636326004417","86617388808543488709773053775821771721","13501644020507883265459618309817100831","217055680356673693475784359801473361125","295025064466402099658419888497216795137","23946388176418599826853943084394685888","226731997445325069769269514614338037757","47156568707413185019407279867207197228","71007857242565876589781318263452524327","33090005617681991691656027794180715864","235373163432968113344524184096267991229","125300827626469622076928128316107576202","295569588323743102613203100475051857177","214091499376293322078611410850926201817","52089497547971689712973718766592706247","307854274376171639293967478132548426675","190971648158080309913330221389997773125","275595207755636872868568948716933840696","193886980122259632568323596240589665047","32960796816410092906706022681035467564","275776125343405168916396249103728464346","45049995380888848386338564909601376530","278456286985633661043559506886268395713","134217034112164692444034510752471178346","63258575288145943258726758251651182470","280909747180340945901701154650345555935","154318887464097148665693902491409355059","101832203030179593893610650727447834237","164283006494565440392648571056447867819","248036362135899575461256789287317014291","89619546740184721779774959992603152204","17328220882884752172771821575753280880","171121164603025888847593109612752073483","33035549135137412476696809515293895463","215676072124937206262999583590400174776","150272259434584903717115481858990392299","62696146518608760450107075380298017534","335828030662545615120496887131186234989","285820217966258463300457884922270893611","144594620530619122640062203041724556463","27985751609344219411959209513634350509","132182085740897500616171402596253460408","201768301399365923569497588698760923273","182819048257112723666670872697815489838","169582387209919031267233374714623647423","311391021797510888953578728583721058099","103566520647297233712022815899724265759","87781187794816270176634885004861289094","291916639781421895268021778430339783839","6845565008264283804561348070709539247","203669520578472635099394390906042932406","91991795871833234658799257913660044257","147198796877310387518641100729773158576","132527948710690674047306735591896862491","216117027442722562394731117148499327069","2148262813004735668062256435421857901","128343471797194152033254470755479850780","34650123701936755770091007842451969438","307503707082305485727724704283837721778","83197696444158879292398807104475372170","124574534566685841162508547725500138249","280003443339954604532842317926837868283","319135176963477130401995775777622271578","165030382898097911025698317283662268855","216101555042994969487203240894972957597","258975616685547778089935852365194114421","74497010644978389685815901564608458109","283428242774970286570974399582558167362"],"threshold":0.9},"id":"ASB-A-499041514-566d5d10"},{"source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"function":"f2fs_compress_pages","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"length":2845,"function_hash":"333082025916956055869217765342830451557"},"id":"ASB-A-499041514-59131c6b","signature_type":"Function","signature_version":"v1"},{"source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"function":"page_array_alloc","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"function_hash":"218573606822950625434780946916294767108","length":332},"id":"ASB-A-499041514-69453a7d","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-499041514-69962f1e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"file":"fs/f2fs/compress.c","function":"f2fs_free_dic"},"deprecated":false,"digest":{"length":730,"function_hash":"175260826828192608557161547606205714801"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a","target":{"file":"fs/f2fs/f2fs.h"},"deprecated":false,"digest":{"line_hashes":["233877380240521296602251489865644179994","101750652174065166225738253589999607533","233459712117975445723824233742720596949","150726952759985247749913167319567998287","138849840685029282507260403610604460579","246368886688693307716534080510714125179","270957124025931039101319385587852202173","63168310339935631114961416973038311986"],"threshold":0.9},"id":"ASB-A-499041514-77e0bfc6"},{"id":"ASB-A-499041514-85bd32f2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"file":"fs/f2fs/compress.c","function":"f2fs_compress_pages"},"deprecated":false,"digest":{"function_hash":"333082025916956055869217765342830451557","length":2845}},{"source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"line_hashes":["93460549504009682191912378729076492705","224997850459333721217930266823868768376","108394170236598334515011525127368199952","73407920136660074807641638594056349301","85259503849476585494467864802635604648","73960982417743782689057887345318705352","221187607062658494155917976150010871027","297865325927233622517502042533006007351","158060336519898321496091760771395137466","215902774869814679395835049662761056010","160787077589459841717200307841532377950","146545757902991409975762709052182917144","136361577883117483296541222324128330352","56774226496245608213720188899083780925","304540044565540693201118420261884696190","103922071390217792232731095636326004417","86617388808543488709773053775821771721","13501644020507883265459618309817100831","217055680356673693475784359801473361125","295025064466402099658419888497216795137","23946388176418599826853943084394685888","226731997445325069769269514614338037757","47156568707413185019407279867207197228","71007857242565876589781318263452524327","33090005617681991691656027794180715864","235373163432968113344524184096267991229","125300827626469622076928128316107576202","295569588323743102613203100475051857177","214091499376293322078611410850926201817","52089497547971689712973718766592706247","307854274376171639293967478132548426675","190971648158080309913330221389997773125","275595207755636872868568948716933840696","193886980122259632568323596240589665047","32960796816410092906706022681035467564","275776125343405168916396249103728464346","45049995380888848386338564909601376530","278456286985633661043559506886268395713","134217034112164692444034510752471178346","63258575288145943258726758251651182470","280909747180340945901701154650345555935","154318887464097148665693902491409355059","101832203030179593893610650727447834237","164283006494565440392648571056447867819","248036362135899575461256789287317014291","89619546740184721779774959992603152204","296473826782694201241433872807614185567","130953268726245751570369255911423561902","213898368531657425416258827122841772077","215676072124937206262999583590400174776","150272259434584903717115481858990392299","62696146518608760450107075380298017534","335828030662545615120496887131186234989","285820217966258463300457884922270893611","144594620530619122640062203041724556463","27985751609344219411959209513634350509","132182085740897500616171402596253460408","201768301399365923569497588698760923273","182819048257112723666670872697815489838","169582387209919031267233374714623647423","311391021797510888953578728583721058099","103566520647297233712022815899724265759","87781187794816270176634885004861289094","291916639781421895268021778430339783839","6845565008264283804561348070709539247","203669520578472635099394390906042932406","91991795871833234658799257913660044257","147198796877310387518641100729773158576","132527948710690674047306735591896862491","216117027442722562394731117148499327069","2148262813004735668062256435421857901","128343471797194152033254470755479850780","34650123701936755770091007842451969438","307503707082305485727724704283837721778","83197696444158879292398807104475372170","124574534566685841162508547725500138249","280003443339954604532842317926837868283","319135176963477130401995775777622271578","165030382898097911025698317283662268855","216101555042994969487203240894972957597","258975616685547778089935852365194114421","74497010644978389685815901564608458109","283428242774970286570974399582558167362"],"threshold":0.9},"id":"ASB-A-499041514-9047115c","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"file":"fs/f2fs/compress.c","function":"page_array_alloc"},"deprecated":false,"digest":{"length":332,"function_hash":"218573606822950625434780946916294767108"},"id":"ASB-A-499041514-998e4ed3","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"function":"f2fs_alloc_dic","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"function_hash":"169199165470287382287496810665069498840","length":1439},"id":"ASB-A-499041514-9c5922ff","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"function":"f2fs_destroy_compress_ctx","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"function_hash":"311872153156619657418855753991177303583","length":281},"id":"ASB-A-499041514-aa5353a8","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a","target":{"file":"fs/f2fs/compress.c","function":"f2fs_decompress_cluster"},"deprecated":false,"digest":{"function_hash":"68922724091764190891647770106921802004","length":1513},"id":"ASB-A-499041514-b69c09c7"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","target":{"function":"f2fs_prepare_decomp_mem","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"function_hash":"251009063058845828252660541478974075106","length":851},"id":"ASB-A-499041514-b88edcf5","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"function":"page_array_free","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"function_hash":"89999943499741124249131594334031796243","length":309},"id":"ASB-A-499041514-ba74b15b","signature_type":"Function"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"function":"f2fs_compress_write_end_io","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"function_hash":"55989782831528650047615861070583905681","length":653},"id":"ASB-A-499041514-c760037c","signature_type":"Function"},{"target":{"file":"fs/f2fs/compress.c","function":"f2fs_init_compress_ctx"},"deprecated":false,"digest":{"function_hash":"217992329313013624045017860555906211598","length":182},"id":"ASB-A-499041514-cf6d90ba","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec"},{"deprecated":false,"digest":{"line_hashes":["233877380240521296602251489865644179994","101750652174065166225738253589999607533","233459712117975445723824233742720596949","150726952759985247749913167319567998287","138849840685029282507260403610604460579","246368886688693307716534080510714125179","270957124025931039101319385587852202173","63168310339935631114961416973038311986"],"threshold":0.9},"id":"ASB-A-499041514-d5af3626","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/84b5a9e56e50b8222cd5999cd8e44d0bdf7fed4f","target":{"file":"fs/f2fs/f2fs.h"}},{"source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8","target":{"function":"f2fs_alloc_dic","file":"fs/f2fs/compress.c"},"deprecated":false,"digest":{"function_hash":"169199165470287382287496810665069498840","length":1439},"id":"ASB-A-499041514-db8c8569","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a","https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec","https://android.googlesource.com/kernel/common/+/84b5a9e56e50b8222cd5999cd8e44d0bdf7fed4f","https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-499041514.json"}}],"schema_version":"1.9.2"}