Executive brief
A vulnerability in the Linux kernel's Flash-Friendly File System (f2fs) can allow a local user to cause a system hang or deadlock. By interacting with a specially crafted or corrupted file system image where internal identifiers (ino and xnid) are identical, the system may enter an infinite loop or lock up when trying to access file attributes. This primarily impacts the availability of the system, potentially requiring a reboot to recover.
Technical details
A deadlock vulnerability exists in the f2fs file system implementation within the Linux kernel. The issue is triggered when a corrupted inode has an extended attribute node ID (xattr_nid) that is identical to its own inode number (i_ino). During operations such as 'mknod', the kernel attempts to lock the directory's inode page and subsequently attempts to lock the same page again while looking up extended attributes (ACLs), resulting in a task hang. The fix introduces a sanity check in 'sanity_check_inode' to ensure these identifiers are distinct. This was discovered via syzbot and affects multiple stable kernel branches.
Affected products
- Linux Linux Kernel 3.8 to 5.4.297, 5.5 to 5.10.241, 5.11 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.95, 6.7 to 6.12.35, 6.13 to 6.15.4
Timeline
- 2025-03-24: patched: Initial patch authored by Chao Yu
- 2025-07-10: disclosed: CVE published
References
- https://git.kernel.org/stable/c/061cf3a84bde038708eb0f1d065b31b7c2456533
- https://git.kernel.org/stable/c/44e904a1ad09e84039058dcbbb1b9ea5b8d7d75d
- https://git.kernel.org/stable/c/5a06d97d5340c00510f24e80e8de821bd3bd9285
- https://git.kernel.org/stable/c/aaddc6c696bd1bff20eaacfa88579d6eae64d541
- https://git.kernel.org/stable/c/c4029044cc408b149e63db7dc8617a0783a3f10d
- https://git.kernel.org/stable/c/e98dc1909f3d5bc078ec7a605524f1e3f4c0eb14
- https://git.kernel.org/stable/c/ecff54aa20b5b21db82e63e46066b55e43d72e78