Executive brief
F2FS is a flash-friendly file system used in Linux kernels. A system crash occurs when F2FS attempts to checkpoint during garbage collection in Log-structured File System (LFS) mode when there is insufficient free space due to dirty pages generated by data migration. This can lead to unexpected system outages and data loss.
Technical details
The vulnerability is a denial-of-service condition triggered in the F2FS subsystem during foreground garbage collection in LFS mode. The root cause is insufficient validation of free space before attempting checkpoint operations; when dirty node and dentry pages generated by data migration exceed available free space, the kernel crashes in the new_curseg function with a null pointer dereference or allocation failure. The attack vector is local and requires filesystem operations that generate sufficient dirty pages (such as heavy random writes to a nearly-full filesystem). The patch adds validation to check whether sufficient free sections exist before initiating checkpoint during garbage collection.
Affected products
- Linux Linux kernel prior to fix
Timeline
- 2025-12-24: disclosed
- patched: Fix involves adding free section validation before checkpoint during gc