why Efail CFB malleability gadget is different from CFB mode decryption? Really, I could not understand why the decryption process of CFB malleability gadget takes the next cipher block while PGP uses the previous block as shown in the equations in the attached image, I read Efail attack paper but I could not understand how it works? Could someone clarify it to me.
Both schemes present in your image represent the same thing. Only the indexing of Ci differ by 1. It all depends on what you consider to be your "first block": 


In the first, you decrypt by manipulating the previous block and the current block. This means your decryption process start with C-1 and C0 to recover P0. Here, C-1 = IV
In the other, you decrypt by manipulating the current block and the next. So P0 = Enc(C0) XOR C1, meaning C0 = IV.




Clarification:

CFB malleability gadget does not modify the decryption process in any way. The only trick is to modify the ciphertext before decryption.

You seem to have trouble with the notation and the block indexing, so here is a little example of how the CFB gadget would be used. In this example, C0 is the first block of encrypted data, the IV is considered apart (whereas C0 is the IV if we follow Efail notation, hence the shift in the index you may notice in my figure).



To make it clear, keeping the same notation as in my figure, CFB decryption would go as follow:


P0 = Enc(IV) xor C0
P1 = Enc(C0) xor C1
P2 = Enc(C1) xor C2
...
Pi = Enc(Ci-1) xor Ci
Pi+1 = Enc(Ci) xor Ci+1
...


That is how CFB decryption works, whether or not you are using it as a gadget.