Linux Kernel
CVE-2024-34027
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege access
-
DeliveryAccess f2fs filesystem with compression enabled
-
ExploitInitiate compress block reserve or release operation
-
ExecutionRace with concurrent checkpoint write
-
PersistInduce or wait for Sudden Power Off during race window
-
ImpactFilesystem metadata corrupted on flash
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Four specific conditions must align simultaneously: (1) the target system must use f2fs as its filesystem - common in Android, embedded Linux, and flash-optimized server deployments but not the default on general Linux distributions; (2) f2fs compression must be explicitly enabled on the filesystem (a non-default feature requiring mount options or mkfs flags); (3) a compress block reservation or release operation must race with an active checkpoint - a narrow timing window requiring concurrent filesystem activity; and (4) a Sudden Power Off must occur during that race window to materialize the metadata corruption. Normal graceful shutdown sequences allow synchronization to complete correctly. Remote exploitation is not possible (AV:L). The race cannot be deterministically triggered from userspace without kernel-level timing control, further reducing exploitability. |
| Impact | The CVSS 7.8 score with AV:L/AC:L/PR:L reflects high potential impact but overstates real-world risk. The AC:L rating does not account for the compound requirement of a specific race timing window combined with a Sudden Power Off event - both must align for exploitation, making AC:H a more accurate characterization. EPSS at 0.02% (6th percentile) confirms negligible exploitation probability. There is no CISA KEV listing and no public exploit code identified. The confidentiality impact listed as High in the vendor CVSS is debatable: the primary harm is data corruption affecting integrity and availability rather than direct data disclosure. Siemens has issued advisory SSA-265688 covering impacted industrial products, indicating supply-chain reach. Overall, this is a reliability defect most relevant to embedded or industrial systems using f2fs with compression, not a priority exploit target. |
| Exploit ScenarioDerived | A local user with standard privileges on an embedded Linux device or Android system using an f2fs partition with compression enabled initiates a compressed file operation that triggers reserve_compress_blocks or release_compress_blocks while a checkpoint is concurrently in progress. If the device experiences an unexpected power loss during this narrow race window, the filesystem metadata written to flash becomes inconsistent - block addresses in dnode structures and inode fields diverge from total_valid_block_count - requiring fsck recovery or risking permanent data loss. No public exploit code exists for this scenario. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 04, 2026
Filesystem metadata corruption in the Linux kernel's f2fs compress subsystem stems from a missing cp_rwsem lock around the reserve_compress_blocks() and release_compress_blocks() functions, creating a race condition with checkpoint operations. Systems using f2fs with compression enabled are at risk of corrupted block addresses in dnode structures, inode fields, and the global total_valid_block_count counter if a Sudden Power Off (SPO) occurs during the race window. No public exploit exists and EPSS is 0.02% (6th percentile), marking this as a data integrity and reliability concern rather than an active attack target.
Earlier versions of this analysis (1)
Filesystem metadata corruption in the Linux kernel's f2fs compression subsystem exposes systems using F2FS with compression enabled to race-condition-induced data loss. The reserve_compress_blocks() and release_compress_blocks() functions execute without holding the cp_rwsem (checkpoint read-write semaphore) lock, allowing concurrent checkpoint operations to produce inconsistent dnode block addresses, inode fields, and the global .total_valid_block_count, particularly during Sudden Power Off (SPO) events. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.02% at the 6th percentile reflects negligible real-world exploitation probability despite the high CVSS score of 7.8.
RemediationAI
Apply the upstream kernel patches: six stable-branch commits are available at git.kernel.org - 0a4ed2d9, 329edb7c, 5d47d638, 69136304, a6e1f774, and b5bac438 - all adding cp_rwsem locking around the compress block reservation and release paths. Distributions should be patched via their respective stable kernel updates. Siemens customers should follow SSA-265688 for product-specific patch guidance. As a compensating control for systems where immediate kernel upgrade is not feasible, disabling f2fs compression (remounting without compress mount options or reformatting without compression) removes the vulnerable code path entirely; the trade-off is loss of storage space savings on flash media. Systems not using f2fs as their filesystem are unaffected and require no action.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
f2fs (Flash-Friendly File System) is a Linux kernel filesystem optimized for NAND flash and SSD storage, widely used in Android devices and embedded Linux systems. The cp_rwsem is a critical read-write semaphore that serializes checkpoint operations - periodic metadata consistency snapshots - against concurrent filesystem modifications. The compress subsystem's block reservation and release paths (reserve_compress_blocks and release_compress_blocks) were not acquiring cp_rwsem, meaning they could execute concurrently with an active checkpoint. This time-of-check-to-time-of-use race, when interrupted by an SPO, leaves dnode block addresses, inode metadata fields, and the global total_valid_block_count in an inconsistent state. The assigned CWE-770 (Allocation of Resources Without Limits) imprecisely describes the root cause - CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) is a better fit, as this is fundamentally a missing lock protecting shared metadata. Affected products per CPE: cpe:2.3:o:linux:linux_kernel across multiple stable branches.
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the compound requirement of a race window plus SPO event; C:L because metadata corruption does not directly disclose confidential data.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
It needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock to avoid racing with checkpoint, otherwise, filesystem metadata including blkaddr in dnode, inode fields and .total_valid_block_count may be corrupted after SPO case.
Executive ViewAI
CVE-2024-34027 affects Linux systems using f2fs (Flash-Friendly Filesystem) with compression enabled, causing potential filesystem corruption and data loss during unexpected power interruptions. While this carries HIGH severity and poses direct data integrity risk to affected infrastructure, no active exploitation has been observed and the vulnerability requires specific timing conditions (race window during power loss) to trigger. Organizations rely on f2fs in embedded and edge deployments must patch to prevent uncontrolled data loss and filesystem failures in production environments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
GitHub PoC
Exploit-DB