Executive brief
A vulnerability in the Linux kernel's F2FS file system could allow a local user to crash the system. By using a specially crafted or corrupted disk image, an attacker can trigger a kernel panic (system crash) when the system attempts to perform certain file operations like 'punching holes' in files. This primarily impacts system availability and could be used as part of a denial-of-service attack.
Technical details
A vulnerability exists in the F2FS file system where a non-inode dnode can be incorrectly parsed as an inode if it shares the same footer.ino and footer.nid values. This confusion causes ADDRS_PER_PAGE() to return an incorrect block address count. Under specific conditions during file truncation (e.g., f2fs_truncate_hole), this leads to a calculation resulting in a zero count, triggering a BUG_ON() assertion and subsequent kernel panic. The fix introduces a new node type (NODE_TYPE_NON_INODE) to ensure proper sanity checking of node footers in f2fs_get_node_folio(). This is exploitable via a crafted filesystem image and local access to trigger fallocate/punch_hole operations.
Affected products
- Linux Linux Kernel 3.8 to 6.17.2
Timeline
- 2025-08-23: other: Patch authored
- 2025-10-28: disclosed: CVE published