Executive brief
The Linux kernel's F2FS filesystem implementation has a buffer overread vulnerability in its recovery logging routines. When logging recovery information for files with maximum-length (255-byte) filenames, the kernel reads past the end of a fixed-size name buffer and exposes raw inode data in log output. This can leak sensitive filesystem metadata to system logs accessible to authorized users.
Technical details
The vulnerability is an information disclosure (buffer overread) in the F2FS recovery code. The root cause is that recover_inode() and recover_dentry() functions use the %s format specifier to print a filename stored in a fixed-size, non-NUL-terminated i_name buffer. For filenames up to 255 bytes (the maximum), the string printing functions read past the buffer boundary into adjacent raw inode fields. The attack vector requires no privileges or network access; the overread occurs during normal filesystem recovery operations triggered by unclean shutdown. The fix introduces recover_printable_name() helper that bounds the print precision to the actual stored name length (min of i_namelen and F2FS_NAME_LEN) before formatting the log message. Patches are available in the Linux stable tree.
Affected products
- Linux Linux Kernel versions prior to upstream commit 01027b2fcb74dade59fb833b51023f6593b6a9a2
Timeline
- 2026-09-16: disclosed
- 2026-08-03: patched: upstream commit 01027b2fcb74dade59fb833b51023f6593b6a9a2