Executive brief
The Linux kernel's f2fs filesystem contains a use-after-free vulnerability in its file truncation logic. When certain inode references are truncated incorrectly, the kernel can access freed memory, potentially causing system crashes or allowing an attacker with local filesystem access to corrupt data or gain elevated privileges.
Technical details
The vulnerability is a use-after-free bug (CWE-416) in the f2fs_truncate_data_blocks_range() function within fs/f2fs/file.c:574. The root cause occurs when truncate_dnode() traverses data block references from an inode's node page without proper validation of the node structure. If inodeA truncates inodeB via cross-inode references, the code can read beyond valid boundaries in inodeB's node page, resulting in out-of-bounds memory access and use-after-free. The attack requires local filesystem access but no privilege escalation or special capabilities. A fix adds sanity checks on the dnode page and introduces an ERROR_INVALID_NODE_REFERENCE error code for fsck detection and repair.
Affected products
- Linux Linux kernel 5.10 through 6.4 (f2fs subsystem)
Timeline
- 2025-12-09: disclosed
- patched