Skip to main content

Linux Kernel CVE-2025-40025

HIGH
2025-10-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux Code Injection
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local access / mount privileges
  2. Delivery
    Supply crafted F2FS image (USB or loopback)
  3. Exploit
    Mount triggers dnode misparse as inode
  4. Execution
    Issue punch-hole fallocate on file
  5. Persist
    count computed as 0 hits BUG_ON
  6. Impact
    Kernel panic (denial of service)

Vulnerability Assessment

Exploitation Conditions

Requires the ability to get a maliciously crafted F2FS filesystem image mounted on the target (via CAP_SYS_ADMIN mount privileges, automount of attacker-supplied removable media, or a loopback mount), plus the ability to issue a punch-hole fallocate against a file on that mounted volume. The corruption is specific: a non-inode direct node must be crafted so footer.ino equals footer.nid, and the punch-hole offset must land such that dn.ofs_in_node coincides with the inode address count (typically 923) so the computed count becomes 0. Limiting factors: exploitation is local only (AV:L), needs privileges to mount (PR:L per CVSS), targets systems with F2FS support compiled in, and yields only a kernel panic/DoS - not code execution or data disclosure despite the 'Code Injection' tag and C:H/I:H rating.
Impact

The assigned CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) - the Linux kernel CNA's default high-impact template - but the observed behavior is a BUG_ON panic, i.e. an availability/denial-of-service issue, not confidentiality or integrity compromise; the C:H/I:H rating overstates real impact and should be treated skeptically. Exploitation is local and further gated by the need to supply a maliciously crafted/fuzzed F2FS image and have it mounted, which in practice requires either mount privileges (CAP_SYS_ADMIN) or an automount path for removable media. EPSS is very low (0.17%), there is no CISA KEV listing, and no public PoC beyond the syzkaller reproduction steps, consistent with a low real-world exploitation priority. Bottom line: patch as part of routine kernel maintenance; this is a robustness/DoS hardening fix, not an urgent RCE despite the high CVSS number.
Exploit ScenarioDerived

A local user or an attacker with brief physical access supplies a specially corrupted F2FS image (e.g., built with mkfs.f2fs then tampered via inject.f2fs to set a dnode's footer so ino==nid) on a USB stick or loopback file. When the image is mounted and a punch-hole fallocate (xfs_io -c 'fpunch') is issued against a file, the kernel misparses the dnode as an inode and hits BUG_ON, panicking the system. No weaponized public exploit exists; only the syzkaller/reproduction script is known.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Local denial-of-service in the Linux kernel's F2FS filesystem allows an attacker who can mount a crafted F2FS image to trigger a kernel BUG_ON panic during a fallocate punch-hole operation. The flaw stems from missing validation of the node footer for non-inode direct nodes (dnodes), which lets a corrupted dnode be misparsed as an inode and produce an invalid truncation count. No public exploit has been identified at time of analysis and EPSS is low (0.17%, 7th percentile); reproduction requires a deliberately fuzzed on-disk image (syzbot-discovered).

RemediationAI

Upstream fix available (commits 186098f34b8a5d65eb828f952c8cc56272c60ea0 and c18ecd99e0c707ef8f83cace861cbc3162f4fdf1 on git.kernel.org/stable); a released patched version is not independently confirmed from the input data, so update to the latest stable/LTS kernel from your distribution that incorporates these commits and rebuild/redeploy. As a specific compensating control where patching is delayed, prevent mounting of untrusted F2FS images: disable automount of removable media (udisks/USB auto-mount), restrict the mount capability so unprivileged users cannot mount filesystems, and blacklist the f2fs module (modprobe blacklist / do not load CONFIG_F2FS_FS) on systems that do not require it - the trade-off is loss of removable-media convenience and inability to use F2FS volumes on that host. On Android/embedded systems that rely on F2FS for internal storage, the module cannot be disabled, so kernel update is the only real remediation.

Affected ProductsAI

The Linux kernel F2FS filesystem is affected; syzbot reproduced the panic on 6.17.0-rc1 (commit 90d970cade8e). No CPE strings were provided in the input, so exact version ranges are not enumerated in the source data, but the two stable-tree fix commits (git.kernel.org/stable/c/186098f34b8a5d65eb828f952c8cc56272c60ea0 and .../c18ecd99e0c707ef8f83cace861cbc3162f4fdf1) indicate the fix was backported to multiple stable branches. Any kernel build with F2FS support (CONFIG_F2FS_FS) prior to those fix commits should be considered vulnerable.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

F2FS (Flash-Friendly File System) is a mainline Linux filesystem optimized for NAND flash and widely used on Android and embedded/flash-storage devices. Each F2FS node page carries a footer identifying its inode number (footer.ino) and node id (footer.nid); a node is treated as an inode when these match. The bug is a validation gap (CWE-20-class improper input validation; CWE is listed N/A in NVD): a non-inode dnode on a malicious image can be crafted so footer.ino footer.nid, causing f2fs_get_node_folio() to parse it as an inode. ADDRS_PER_PAGE() then returns the inode block-address count (typically 923); when dn.ofs_in_node happens to equal 923, the computed count in f2fs_truncate_hole() becomes 0, tripping f2fs_bug_on(count 0 ...) at fs/f2fs/file.c:1243 and panicking the kernel. The fix adds a NODE_TYPE_NON_INODE type passed into sanity_check_node_footer() to reject dnodes whose footer falsely claims inode identity.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.5 MEDIUM

Local trigger requiring mount privileges (PR:L, AV:L) with reliable BUG_ON panic; impact is a kernel crash only, so A:H and C:N/I:N rather than the CNA's default C:H/I:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on node footer for non inode dnode

As syzbot reported below:

------------[ cut here ]------------ kernel BUG at fs/f2fs/file.c:1243! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full) RIP: 0010:f2fs_truncate_hole+0x69e/0x6c0 fs/f2fs/file.c:1243 Call Trace: <TASK> f2fs_punch_hole+0x2db/0x330 fs/f2fs/file.c:1306 f2fs_fallocate+0x546/0x990 fs/f2fs/file.c:2018 vfs_fallocate+0x666/0x7e0 fs/open.c:342 ksys_fallocate fs/open.c:366 [inline] __do_sys_fallocate fs/open.c:371 [inline] __se_sys_fallocate fs/open.c:369 [inline] __x64_sys_fallocate+0xc0/0x110 fs/open.c:369 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1e65f8ebe9

w/ a fuzzed image, f2fs may encounter panic due to it detects inconsistent truncation range in direct node in f2fs_truncate_hole().

The root cause is: a non-inode dnode may has the same footer.ino and footer.nid, so the dnode will be parsed as an inode, then ADDRS_PER_PAGE() may return wrong blkaddr count which may be 923 typically, by chance, dn.ofs_in_node is equal to 923, then count can be calculated to 0 in below statement, later it will trigger panic w/ f2fs_bug_on(, count == 0 || ...).

count = min(end_offset - dn.ofs_in_node, pg_end - pg_start);

This patch introduces a new node_type NODE_TYPE_NON_INODE, then allowing passing the new_type to sanity_check_node_footer in f2fs_get_node_folio() to detect corruption that a non-inode dnode has the same footer.ino and footer.nid.

Scripts to reproduce: mkfs.f2fs -f /dev/vdb mount /dev/vdb /mnt/f2fs touch /mnt/f2fs/foo touch /mnt/f2fs/bar dd if=/dev/zero of=/mnt/f2fs/foo bs=1M count=8 umount /mnt/f2fs inject.f2fs --node --mb i_nid --nid 4 --idx 0 --val 5 /dev/vdb mount /dev/vdb /mnt/f2fs xfs_io /mnt/f2fs/foo -c "fpunch 6984k 4k"

Executive ViewAI

Why It Matters

A local denial-of-service vulnerability in the Linux kernel's F2FS filesystem (CVE-2025-40025) can trigger kernel panic when unprivileged users mount a deliberately crafted filesystem image. Exploitation requires local access and attack sophistication; no patch is currently available. Risk is concentrated in systems permitting untrusted parties or processes to mount F2FS filesystems.

Business Impact: Medium
Compensating Controls

Restrict F2FS mount permissions to root only (add nouser option in /etc/fstab); disable F2FS if not operationally required; enforce filesystem mount access controls via SELinux or AppArmor; monitor kernel logs for F2FS-related BUG_ON panics and alert on occurrence; monitor Linux vendor security advisories for patch release.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
High
Linux kernel is ubiquitous but F2FS is an optional subsystem, common mainly on Android/flash devices
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8781-1 REF https://git.kernel.org/stable/c/186098f34b8a5d65eb828f952c8cc56272c60ea0 REF https://git.kernel.org/stable/c/c18ecd99e0c707ef8f83cace861cbc3162f4fdf1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy