Executive brief
A vulnerability in the Linux kernel's F2FS file system could allow a local user to crash the system. The issue occurs when the system incorrectly handles encrypted data during specific 'atomic write' operations, leading to a system failure (kernel panic). This primarily impacts the availability of the system and any services running on it.
Technical details
A NULL pointer dereference exists in the F2FS file system implementation within the Linux kernel during atomic write operations. The root cause is a mismatch between the inode used to locate Copy-on-Write (COW) data and the inode used for decryption context. Specifically, f2fs_write_begin() may use a COW inode to build a read bio, triggering fs-layer decryption (STEP_DECRYPT) based on the COW inode's encryption policy. If the original inode is unencrypted but the COW inode (inherited from a parent directory) is encrypted, the decryption path attempts to access a NULL i_crypt_info pointer on the original inode's folio. This results in a general protection fault and kernel panic. The fix involves using the original inode for the post-read crypto context.
Affected products
- Linux Linux Kernel 591fc34e1f98 to a92332f32a8d31a7eee47b1dc1d751cb3319908f
Timeline
- 2026-06-15: other: Patch authored
- 2026-07-04: patched: Patch committed to stable tree
- 2026-07-19: disclosed: CVE published