Executive brief
A vulnerability in the Linux kernel's F2FS file system could allow a system crash (kernel panic) when mounting a specially crafted disk image. The issue occurs because the system does not properly verify certain internal file system data during the recovery process. This could be used by an attacker with physical access or the ability to provide a malicious storage device to disrupt system operations.
Technical details
A vulnerability exists in the f2fs_recover_orphan_inodes() function within the Linux kernel's F2FS implementation. The function fails to validate the 'entry_count' field when replaying orphan inodes from the checkpoint pack. If a crafted image contains an entry_count larger than F2FS_ORPHANS_PER_BLOCK, the recovery loop performs an out-of-bounds read past the ino[] array, potentially interpreting metadata as inode numbers and triggering a f2fs_bug_on() call, resulting in a kernel panic. The fix introduces validation of entry_count before processing and ensures the mount fails with -EFSCORRUPTED if inconsistencies are detected.
Affected products
- Linux Linux 3.8 to 6.12.96, 6.18.38, 7.1.3
Timeline
- 2026-07-19: advisory: NVD publication date
- 2026-07-04: patched: Fix committed to stable tree