Executive brief
The F2FS filesystem in the Linux kernel has a bug in how it cleans up in-progress atomic file writes when they are aborted. When an atomic write operation is cancelled, a stale dirty flag can remain on the inode, causing the kernel to panic during file system shutdown. This can lead to system crashes or data loss if the filesystem is unmounted unexpectedly.
Technical details
The vulnerability is a state-tracking bug in the F2FS inode eviction path. When f2fs_abort_atomic_write() is called, it marks the inode as dirty but does not flush it before the inode is evicted. Later, f2fs_evict_inode() triggers a BUG_ON() check that asserts no FI_DIRTY_INODE flag should be set during eviction, causing a kernel panic. The bug occurs in the call stack during filesystem shutdown when evict_inodes() is called. The fix is to explicitly flush the inode during atomic write abort to ensure the dirty flag is cleared. The vulnerability was resolved by flushing the inode being aborted atomic operation.
Affected products
- Linux Linux kernel 6.4.0 and likely earlier versions
Timeline
- 2025-12-09: disclosed