Executive brief
A vulnerability in the Linux kernel's F2FS file system can cause a complete system crash (kernel panic). This occurs when the file system is used in a specific configuration (LFS mode) and multiple processes attempt to write data simultaneously, leading to an out-of-space error that the system cannot handle gracefully. An exploit of this flaw would result in a denial of service, disrupting operations and potentially causing data loss due to the sudden system failure.
Technical details
A kernel BUG (panic) exists in the F2FS file system component of the Linux kernel, specifically within the segment management logic. When the file system is mounted with the 'mode=lfs' option, the 'f2fs_map_blocks()' function performs aggressive block allocations using Out-Place-Update (OPU). Under heavy parallel I/O (AIO/DIO), the system can run out of physical space before foreground garbage collection (GC) is triggered, leading to a 'kernel BUG at fs/f2fs/segment.c'. The fix ensures foreground GC is triggered prior to block allocation in LFS mode. This is a local denial-of-service vulnerability requiring the ability to perform file writes on an F2FS partition.
Affected products
- Linux Linux Kernel 4.8 to 6.6.102, 6.7 to 6.12.42, 6.13 to 6.15.10, 6.16 to 6.16.1
Timeline
- 2025-08-22: advisory: NVD publication date
- 2025-07-24: patched: Initial patch authored by Chao Yu
References
- https://git.kernel.org/stable/c/1005a3ca28e90c7a64fa43023f866b960a60f791
- https://git.kernel.org/stable/c/264ede8a52f18647ed5bb5f2bd9bf54f556ad8f5
- https://git.kernel.org/stable/c/385e64a0744584397b4b52b27c96703516f39968
- https://git.kernel.org/stable/c/82765ce5c7a56f9309ee45328e763610eaf11253
- https://git.kernel.org/stable/c/c737047f4665232d1e26b3620bc62df334545451
- https://git.kernel.org/stable/c/d2f280f43a2a9d918fd23169ff3a6f3b65c7cec5
- https://git.kernel.org/stable/c/f289690f50a01c3e085d87853392d5b7436a4cee