Executive brief
A vulnerability was identified in the Linux kernel's F2FS file system, which is commonly used on Android devices and flash storage. A race condition during data writing could lead to a system crash or potential unauthorized access to memory. This issue primarily affects system stability and could be exploited by a local user to cause a denial of service.
Technical details
A use-after-free (UAF) vulnerability exists in the f2fs_merge_page_bio() function within the F2FS file system driver. The flaw is rooted in a race condition where a bounced page (fio->encrypted_page) is accessed after it has been freed by the fscrypt_free_bounce_page() function during an I/O completion interrupt. This occurs when multiple threads perform concurrent writes and syncs on encrypted files, causing the kernel to dereference a NULL or invalid pointer in f2fs_is_cp_guaranteed(). The fix involves ensuring the kernel uses the original folio instead of the potentially freed encrypted bounce page after the page is committed to the internal IPU cache. Patches have been merged into the stable Linux kernel branches.
Affected products
- Linux Linux Kernel 5.5 to 6.17.3
Timeline
- 2025-09-28: patched: Initial fix commit edf7e9040fc52c922db947f9c6c36f07377c52ea authored
- 2025-10-28: advisory: CVE-2025-40054 published