Executive brief
The Linux kernel's f2fs filesystem contains a race condition in its compression code that can cause the system to crash when files are written concurrently. When multiple processes write to the same compressed file simultaneously, the kernel can attempt to mark a page as finished writing multiple times, triggering a fatal kernel error (BUG_ON) and resulting in system unavailability.
Technical details
The vulnerability is a concurrency race condition in f2fs_write_raw_pages() where page writeback state is not properly synchronized during concurrent write operations. The root cause stems from commit 7377e853967b which released page locks early to prevent deadlocks, but failed to wait for any in-flight writeback operations. When Process A writes a page, unlocks it after marking it for writeback, and then Process B/C perform additional writes to the same page, the kernel's folio_end_writeback() function can be called multiple times on the same page, triggering BUG_ON() at mm/filemap.c:1619. The fix involves calling f2fs_wait_on_page_writeback() before subsequent write operations to ensure writeback completes before the page is reused. The vulnerability affects the Linux kernel and requires a patched version with the fix applied.
Affected products
- Linux Linux kernel versions affected by commit 7377e853967b onwards
Timeline
- 2025-12-24: disclosed