{"id":"ASB-A-499041514", "published":"2026-11-01T00:00:00Z", "modified":"2026-11-05T16:32:28.703711716Z", "aliases":["CVE-2025-38627", "A-499041514"], "details":"In multiple functions of compress.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":":linux_kernel:", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":":0"}, {"fixed":":2026-11-05"}]}], "versions":["Kernel"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a", "https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "https://android.googlesource.com/kernel/common/+/84b5a9e56e50b8222cd5999cd8e44d0bdf7fed4f", "https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8"], "severity":"High", "spl":"2026-11-05", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"55989782831528650047615861070583905681", "length":653}, "id":"ASB-A-499041514-0a6df951", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_compress_write_end_io"}}, {"deprecated":false, "digest":{"function_hash":"23911516186151812126285498025494064902", "length":4838}, "id":"ASB-A-499041514-16e61a7c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_write_compressed_pages"}}, {"deprecated":false, "digest":{"function_hash":"217992329313013624045017860555906211598", "length":182}, "id":"ASB-A-499041514-21919c62", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_init_compress_ctx"}}, {"deprecated":false, "digest":{"function_hash":"89999943499741124249131594334031796243", "length":309}, "id":"ASB-A-499041514-299615ec", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"page_array_free"}}, {"deprecated":false, "digest":{"function_hash":"270266926901652386660951561374926219100", "length":4548}, "id":"ASB-A-499041514-2b927b89", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_write_compressed_pages"}}, {"deprecated":false, "digest":{"function_hash":"175260826828192608557161547606205714801", "length":730}, "id":"ASB-A-499041514-3df8e609", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_free_dic"}}, {"deprecated":false, "digest":{"function_hash":"311872153156619657418855753991177303583", "length":281}, "id":"ASB-A-499041514-4c82007b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_destroy_compress_ctx"}}, {"deprecated":false, "digest":{"function_hash":"251009063058845828252660541478974075106", "length":851}, "id":"ASB-A-499041514-4f827997", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_prepare_decomp_mem"}}, {"deprecated":false, "digest":{"line_hashes":["93460549504009682191912378729076492705", "224997850459333721217930266823868768376", "108394170236598334515011525127368199952", "73407920136660074807641638594056349301", "85259503849476585494467864802635604648", "73960982417743782689057887345318705352", "221187607062658494155917976150010871027", "297865325927233622517502042533006007351", "158060336519898321496091760771395137466", "215902774869814679395835049662761056010", "160787077589459841717200307841532377950", "146545757902991409975762709052182917144", "136361577883117483296541222324128330352", "56774226496245608213720188899083780925", "304540044565540693201118420261884696190", "103922071390217792232731095636326004417", "86617388808543488709773053775821771721", "13501644020507883265459618309817100831", "217055680356673693475784359801473361125", "295025064466402099658419888497216795137", "23946388176418599826853943084394685888", "226731997445325069769269514614338037757", "47156568707413185019407279867207197228", "71007857242565876589781318263452524327", "33090005617681991691656027794180715864", "235373163432968113344524184096267991229", "125300827626469622076928128316107576202", "295569588323743102613203100475051857177", "214091499376293322078611410850926201817", "52089497547971689712973718766592706247", "307854274376171639293967478132548426675", "190971648158080309913330221389997773125", "275595207755636872868568948716933840696", "193886980122259632568323596240589665047", "32960796816410092906706022681035467564", "275776125343405168916396249103728464346", "45049995380888848386338564909601376530", "278456286985633661043559506886268395713", "134217034112164692444034510752471178346", "63258575288145943258726758251651182470", "280909747180340945901701154650345555935", "154318887464097148665693902491409355059", "101832203030179593893610650727447834237", "164283006494565440392648571056447867819", "248036362135899575461256789287317014291", "89619546740184721779774959992603152204", "17328220882884752172771821575753280880", "171121164603025888847593109612752073483", "33035549135137412476696809515293895463", "215676072124937206262999583590400174776", "150272259434584903717115481858990392299", "62696146518608760450107075380298017534", "335828030662545615120496887131186234989", "285820217966258463300457884922270893611", "144594620530619122640062203041724556463", "27985751609344219411959209513634350509", "132182085740897500616171402596253460408", "201768301399365923569497588698760923273", "182819048257112723666670872697815489838", "169582387209919031267233374714623647423", "311391021797510888953578728583721058099", "103566520647297233712022815899724265759", "87781187794816270176634885004861289094", "291916639781421895268021778430339783839", "6845565008264283804561348070709539247", "203669520578472635099394390906042932406", "91991795871833234658799257913660044257", "147198796877310387518641100729773158576", "132527948710690674047306735591896862491", "216117027442722562394731117148499327069", "2148262813004735668062256435421857901", "128343471797194152033254470755479850780", "34650123701936755770091007842451969438", "307503707082305485727724704283837721778", "83197696444158879292398807104475372170", "124574534566685841162508547725500138249", "280003443339954604532842317926837868283", "319135176963477130401995775777622271578", "165030382898097911025698317283662268855", "216101555042994969487203240894972957597", "258975616685547778089935852365194114421", "74497010644978389685815901564608458109", "283428242774970286570974399582558167362"], "threshold":0.9}, "id":"ASB-A-499041514-566d5d10", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c"}}, {"deprecated":false, "digest":{"function_hash":"333082025916956055869217765342830451557", "length":2845}, "id":"ASB-A-499041514-59131c6b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_compress_pages"}}, {"deprecated":false, "digest":{"function_hash":"218573606822950625434780946916294767108", "length":332}, "id":"ASB-A-499041514-69453a7d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"page_array_alloc"}}, {"deprecated":false, "digest":{"function_hash":"175260826828192608557161547606205714801", "length":730}, "id":"ASB-A-499041514-69962f1e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_free_dic"}}, {"deprecated":false, "digest":{"line_hashes":["233877380240521296602251489865644179994", "101750652174065166225738253589999607533", "233459712117975445723824233742720596949", "150726952759985247749913167319567998287", "138849840685029282507260403610604460579", "246368886688693307716534080510714125179", "270957124025931039101319385587852202173", "63168310339935631114961416973038311986"], "threshold":0.9}, "id":"ASB-A-499041514-77e0bfc6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a", "target":{"file":"fs/f2fs/f2fs.h"}}, {"deprecated":false, "digest":{"function_hash":"333082025916956055869217765342830451557", "length":2845}, "id":"ASB-A-499041514-85bd32f2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_compress_pages"}}, {"deprecated":false, "digest":{"line_hashes":["93460549504009682191912378729076492705", "224997850459333721217930266823868768376", "108394170236598334515011525127368199952", "73407920136660074807641638594056349301", "85259503849476585494467864802635604648", "73960982417743782689057887345318705352", "221187607062658494155917976150010871027", "297865325927233622517502042533006007351", "158060336519898321496091760771395137466", "215902774869814679395835049662761056010", "160787077589459841717200307841532377950", "146545757902991409975762709052182917144", "136361577883117483296541222324128330352", "56774226496245608213720188899083780925", "304540044565540693201118420261884696190", "103922071390217792232731095636326004417", "86617388808543488709773053775821771721", "13501644020507883265459618309817100831", "217055680356673693475784359801473361125", "295025064466402099658419888497216795137", "23946388176418599826853943084394685888", "226731997445325069769269514614338037757", "47156568707413185019407279867207197228", "71007857242565876589781318263452524327", "33090005617681991691656027794180715864", "235373163432968113344524184096267991229", "125300827626469622076928128316107576202", "295569588323743102613203100475051857177", "214091499376293322078611410850926201817", "52089497547971689712973718766592706247", "307854274376171639293967478132548426675", "190971648158080309913330221389997773125", "275595207755636872868568948716933840696", "193886980122259632568323596240589665047", "32960796816410092906706022681035467564", "275776125343405168916396249103728464346", "45049995380888848386338564909601376530", "278456286985633661043559506886268395713", "134217034112164692444034510752471178346", "63258575288145943258726758251651182470", "280909747180340945901701154650345555935", "154318887464097148665693902491409355059", "101832203030179593893610650727447834237", "164283006494565440392648571056447867819", "248036362135899575461256789287317014291", "89619546740184721779774959992603152204", "296473826782694201241433872807614185567", "130953268726245751570369255911423561902", "213898368531657425416258827122841772077", "215676072124937206262999583590400174776", "150272259434584903717115481858990392299", "62696146518608760450107075380298017534", "335828030662545615120496887131186234989", "285820217966258463300457884922270893611", "144594620530619122640062203041724556463", "27985751609344219411959209513634350509", "132182085740897500616171402596253460408", "201768301399365923569497588698760923273", "182819048257112723666670872697815489838", "169582387209919031267233374714623647423", "311391021797510888953578728583721058099", "103566520647297233712022815899724265759", "87781187794816270176634885004861289094", "291916639781421895268021778430339783839", "6845565008264283804561348070709539247", "203669520578472635099394390906042932406", "91991795871833234658799257913660044257", "147198796877310387518641100729773158576", "132527948710690674047306735591896862491", "216117027442722562394731117148499327069", "2148262813004735668062256435421857901", "128343471797194152033254470755479850780", "34650123701936755770091007842451969438", "307503707082305485727724704283837721778", "83197696444158879292398807104475372170", "124574534566685841162508547725500138249", "280003443339954604532842317926837868283", "319135176963477130401995775777622271578", "165030382898097911025698317283662268855", "216101555042994969487203240894972957597", "258975616685547778089935852365194114421", "74497010644978389685815901564608458109", "283428242774970286570974399582558167362"], "threshold":0.9}, "id":"ASB-A-499041514-9047115c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c"}}, {"deprecated":false, "digest":{"function_hash":"218573606822950625434780946916294767108", "length":332}, "id":"ASB-A-499041514-998e4ed3", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"page_array_alloc"}}, {"deprecated":false, "digest":{"function_hash":"169199165470287382287496810665069498840", "length":1439}, "id":"ASB-A-499041514-9c5922ff", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_alloc_dic"}}, {"deprecated":false, "digest":{"function_hash":"311872153156619657418855753991177303583", "length":281}, "id":"ASB-A-499041514-aa5353a8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_destroy_compress_ctx"}}, {"deprecated":false, "digest":{"function_hash":"68922724091764190891647770106921802004", "length":1513}, "id":"ASB-A-499041514-b69c09c7", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_decompress_cluster"}}, {"deprecated":false, "digest":{"function_hash":"251009063058845828252660541478974075106", "length":851}, "id":"ASB-A-499041514-b88edcf5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_prepare_decomp_mem"}}, {"deprecated":false, "digest":{"function_hash":"89999943499741124249131594334031796243", "length":309}, "id":"ASB-A-499041514-ba74b15b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"page_array_free"}}, {"deprecated":false, "digest":{"function_hash":"55989782831528650047615861070583905681", "length":653}, "id":"ASB-A-499041514-c760037c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_compress_write_end_io"}}, {"deprecated":false, "digest":{"function_hash":"217992329313013624045017860555906211598", "length":182}, "id":"ASB-A-499041514-cf6d90ba", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_init_compress_ctx"}}, {"deprecated":false, "digest":{"line_hashes":["233877380240521296602251489865644179994", "101750652174065166225738253589999607533", "233459712117975445723824233742720596949", "150726952759985247749913167319567998287", "138849840685029282507260403610604460579", "246368886688693307716534080510714125179", "270957124025931039101319385587852202173", "63168310339935631114961416973038311986"], "threshold":0.9}, "id":"ASB-A-499041514-d5af3626", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/84b5a9e56e50b8222cd5999cd8e44d0bdf7fed4f", "target":{"file":"fs/f2fs/f2fs.h"}}, {"deprecated":false, "digest":{"function_hash":"169199165470287382287496810665069498840", "length":1439}, "id":"ASB-A-499041514-db8c8569", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8", "target":{"file":"fs/f2fs/compress.c", "function":"f2fs_alloc_dic"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-11-01"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/5d604d40cd3232b09cb339941ef958e49283ed0a"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/4e9efe0d56e73d10e2f72e0328b537cea93198ec"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/84b5a9e56e50b8222cd5999cd8e44d0bdf7fed4f"}, {"type":"FIX", "url":"https://android.googlesource.com/kernel/common/+/eb95d43efb6bc27e17a5b98031ee41b5f9eee3a8"}]}