Executive brief
A vulnerability in the Linux kernel's Flash-Friendly File System (F2FS) could allow a local user to crash the system. By using a specially crafted or corrupted disk image, an attacker can trigger a kernel bug during file system operations. This results in a complete system halt (denial of service), potentially disrupting operations and requiring a reboot.
Technical details
A vulnerability exists in the Linux kernel F2FS file system where node footer sanity checks are bypassed during asynchronous I/O operations such as f2fs_ra_node_pages(). If a corrupted or fuzzed disk image contains inconsistent node page indices (nid) in the footer, the kernel may load these corrupted pages. When these pages later become dirty and undergo writeback, the inconsistency is detected in f2fs_write_end_io(), triggering a kernel BUG at fs/f2fs/data.c:358. This results in a local denial of service. Patches have been released for various stable branches including 6.19.3 and 6.18.13.
Affected products
- Linux Linux kernel 3.8 to 6.18.13, 6.19 to 6.19.3
Timeline
- 2026-03-18: advisory: Initial CVE publication
- 2026-01-17: patched: Mainline kernel patch committed
- 2026-05-29: other: NIST initial analysis completed