Executive brief
A vulnerability in the Linux kernel's F2FS file system could allow a local user to crash the system. By providing a specially crafted or corrupted disk image, an attacker can trigger a kernel panic (system crash) when the system attempts to process certain file operations. This primarily impacts the availability of the affected system.
Technical details
A vulnerability in the F2FS file system's f2fs_get_node_folio_ra() function fails to properly validate node footers in corrupted inodes. Specifically, if a corrupted inode contains a direct node with matching 'ino' and 'nid' values in its footer, the ADDRS_PER_PAGE calculation can lead to an out-of-bounds condition where dn.ofs_in_node exceeds the expected range. This triggers a 'f2fs_bug_on' and subsequent kernel panic. The fix introduces a new node type check (NODE_TYPE_NON_IXNODE) within f2fs_sanity_check_node_footer to detect and reject inconsistent node chains during truncation and data access paths.
Affected products
- Linux Linux Kernel f2fs file system component
Timeline
- 2026-05-22: disclosed: Initial patch authored by Chao Yu
- 2026-07-04: patched: Patch committed to stable tree
- 2026-07-19: advisory: CVE published by NVD