CVE-2025-38620: 
Linux Ubuntu vulnerability analysis and mitigation

A use-after-free vulnerability was discovered in the Linux kernel's zloop (zoned loop device) implementation. The vulnerability was identified on August 22, 2025, and affects the kernel's memory management when handling zloop devices. The issue occurs in the zloopctlremove() function which incorrectly handles memory deallocation sequence (Ubuntu Security).

The vulnerability stems from a race condition in the zloopctlremove() function. Specifically, the function calls putdisk(), which invokes zloopfreedisk(). The zloopfreedisk() function frees the memory allocated for the zlo pointer. However, after this deallocation, zloopctlremove() attempts to access the freed memory by calling blkmqfreetagset(&zlo->tagset), resulting in a KASAN use-after-free detection (Ubuntu Security).

When triggered, this vulnerability can lead to kernel memory corruption due to the use-after-free condition. The issue is particularly concerning as it affects the kernel's block layer functionality and could potentially be exploited to cause system instability or privilege escalation (Ubuntu Security).

The fix involves restructuring the deallocation sequence by moving the blkmqfreetagset(&zlo->tagset) call from zloopctlremove() into zloopfreedisk(). This ensures that the tagset is freed before the call to kvfree(zlo), preventing the use-after-free condition (Ubuntu Security).