CVE-2025-40150
Lifecycle Timeline
2Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid migrating empty section It reports a bug from device w/ zufs: F2FS-fs (dm-64): Inconsistent segment (173822) type [1, 0] in SSA and SIT F2FS-fs (dm-64): Stopped filesystem due to reason: 4 Thread A Thread B - f2fs_expand_inode_data - f2fs_allocate_pinning_section - f2fs_gc_range - do_garbage_collect w/ segno #x - writepage - f2fs_allocate_data_block - new_curseg - allocate segno #x The root cause is: fallocate on pinning file may race w/ block allocation as above, result in do_garbage_collect() from fallocate() may migrate segment which is just allocated by a log, the log will update segment type in its in-memory structure, however GC will get segment type from on-disk SSA block, once segment type changes by log, we can detect such inconsistency, then shutdown filesystem. In this case, on-disk SSA shows type of segno #173822 is 1 (SUM_TYPE_NODE), however segno #173822 was just allocated as data type segment, so in-memory SIT shows type of segno #173822 is 0 (SUM_TYPE_DATA). Change as below to fix this issue: - check whether current section is empty before gc - add sanity checks on do_garbage_collect() to avoid any race case, result in migrating segment used by log. - btw, it fixes misc issue in printed logs: "SSA and SIT" -> "SIT and SSA".
Analysis
Linux kernel F2FS filesystem implementation contains a race condition between garbage collection and block allocation that causes segment type inconsistencies, leading to filesystem shutdown. The vulnerability affects systems using F2FS with pinned files during concurrent fallocate and writepage operations. While the EPSS score is low at 0.03%, this is a kernel-level denial of service affecting data availability on affected systems.
Technical Context
The vulnerability exists in the F2FS (Flash-Friendly File System) implementation within the Linux kernel. F2FS is a log-structured filesystem optimized for NAND flash storage. The root cause is a race condition in the garbage collection (GC) mechanism, specifically when do_garbage_collect() is invoked during pinned file expansion via f2fs_allocate_pinning_section(). Concurrently, block allocation via f2fs_allocate_data_block() may allocate the same segment that GC is attempting to migrate. The GC process reads on-disk Segment Summary Area (SSA) metadata showing an old segment type, while the in-memory Segment Information Table (SIT) reflects the newly allocated segment type. This mismatch triggers the inconsistency detection and filesystem shutdown. The vulnerability is classified under race condition handling and improper synchronization between kernel subsystems.
Affected Products
The Linux kernel is affected, specifically versions containing the vulnerable F2FS code path prior to the fix commits. Affected systems are those using F2FS as the active filesystem with pinned file support enabled. The vulnerability has been resolved in upstream kernel commits 25d2dc669f2a7e48b335d1cb07139f2ffc9fe5df, d625a2b08c089397d3a03bff13fa8645e4ec7a01, db489778e6f2a4034c2cd26fadda2796eba24dcd, and eec1589be36fcf7440755703e4faeee2c01e360b per the provided references. Exact kernel version ranges are not specified in available data; administrators should verify F2FS kernel module version against these commit identifiers in their distribution's changelog.
Remediation
Update the Linux kernel to a version incorporating the four fix commits (25d2dc669f2a7e48b335d1cb07139f2ffc9fe5df, d625a2b08c089397d3a03bff13fa8645e4ec7a01, db489778e6f2a4034c2cd26fadda2796eba24dcd, eec1589be36fcf7440755703e4faeee2c01e360b), typically available in stable kernel releases following the upstream fix. Consult your Linux distribution's advisory and kernel changelog to identify the first patched version. As an interim mitigation, avoid concurrent fallocate operations on pinned F2FS files during active I/O workloads, or consider switching to an alternative filesystem (ext4, btrfs) if F2FS is not critical to your deployment. Verify kernel source commit history at https://git.kernel.org/stable/ to confirm patch inclusion in your target kernel version.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today