Executive brief
A vulnerability was identified in the Linux kernel's Flash-Friendly File System (F2FS) that could allow a local user to crash the system or potentially execute unauthorized actions. The issue occurs when a compressed file is read and then immediately deleted, causing the system to try and access data that has already been cleared from memory. This flaw primarily impacts system stability and data integrity on devices using F2FS, such as many Android smartphones and flash-based storage systems.
Technical details
A use-after-free (UAF) vulnerability exists in the F2FS file system's compression implementation, specifically within the 'f2fs_free_dic' function. The root cause is a race condition where the 'decompress_io_ctx' is released asynchronously after I/O completion; if a file is deleted immediately after a read operation under high workload, the 'f2fs_inode_info' may be evicted and freed before the background kworker ('post_read_wq') can process the decompression context. An attacker with local access could exploit this race condition to trigger a kernel crash or potentially achieve privilege escalation. The fix involves storing the 'compress_algorithm' and 'sbi' directly in the decompression context ('dic') to avoid referencing the potentially freed inode.
Affected products
- Linux Linux Kernel 6.0 to 6.16.1
Timeline
- 2025-08-22: advisory: Initial disclosure and publication
- 2025-08-22: patched: Fixes merged into stable branches
References
- https://git.kernel.org/stable/c/39868685c2a94a70762bc6d77dc81d781d05bff5
- https://git.kernel.org/stable/c/5d604d40cd3232b09cb339941ef958e49283ed0a
- https://git.kernel.org/stable/c/74cbeeca4f16823ba58c882e1d8b836c0e39c93d
- https://git.kernel.org/stable/c/8fae5b6addd5f6895e03797b56e3c7b9f9cd15c9
- https://git.kernel.org/stable/c/cc81768212cdc509e5a986274db7bc24d18cde19