Linux Kernel
CVE-2025-40150
Lifecycle Timeline
2DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid migrating empty section
It reports a bug from device w/ zufs:
F2FS-fs (dm-64): Inconsistent segment (173822) type [1, 0] in SSA and SIT F2FS-fs (dm-64): Stopped filesystem due to reason: 4
Thread A Thread B
- f2fs_expand_inode_data
- f2fs_allocate_pinning_section
- f2fs_gc_range
- do_garbage_collect w/ segno #x
- writepage
- f2fs_allocate_data_block
- new_curseg
- allocate segno #x
The root cause is: fallocate on pinning file may race w/ block allocation as above, result in do_garbage_collect() from fallocate() may migrate segment which is just allocated by a log, the log will update segment type in its in-memory structure, however GC will get segment type from on-disk SSA block, once segment type changes by log, we can detect such inconsistency, then shutdown filesystem.
In this case, on-disk SSA shows type of segno #173822 is 1 (SUM_TYPE_NODE), however segno #173822 was just allocated as data type segment, so in-memory SIT shows type of segno #173822 is 0 (SUM_TYPE_DATA).
Change as below to fix this issue:
- check whether current section is empty before gc
- add sanity checks on do_garbage_collect() to avoid any race case, result
in migrating segment used by log.
- btw, it fixes misc issue in printed logs: "SSA and SIT" -> "SIT and SSA".
AnalysisAI
Linux kernel F2FS filesystem implementation contains a race condition between garbage collection and block allocation that causes segment type inconsistencies, leading to filesystem shutdown. The vulnerability affects systems using F2FS with pinned files during concurrent fallocate and writepage operations. While the EPSS score is low at 0.03%, this is a kernel-level denial of service affecting data availability on affected systems.
Technical ContextAI
The vulnerability exists in the F2FS (Flash-Friendly File System) implementation within the Linux kernel. F2FS is a log-structured filesystem optimized for NAND flash storage. The root cause is a race condition in the garbage collection (GC) mechanism, specifically when do_garbage_collect() is invoked during pinned file expansion via f2fs_allocate_pinning_section(). Concurrently, block allocation via f2fs_allocate_data_block() may allocate the same segment that GC is attempting to migrate. The GC process reads on-disk Segment Summary Area (SSA) metadata showing an old segment type, while the in-memory Segment Information Table (SIT) reflects the newly allocated segment type. This mismatch triggers the inconsistency detection and filesystem shutdown. The vulnerability is classified under race condition handling and improper synchronization between kernel subsystems.
Affected ProductsAI
The Linux kernel is affected, specifically versions containing the vulnerable F2FS code path prior to the fix commits. Affected systems are those using F2FS as the active filesystem with pinned file support enabled. The vulnerability has been resolved in upstream kernel commits 25d2dc669f2a7e48b335d1cb07139f2ffc9fe5df, d625a2b08c089397d3a03bff13fa8645e4ec7a01, db489778e6f2a4034c2cd26fadda2796eba24dcd, and eec1589be36fcf7440755703e4faeee2c01e360b per the provided references. Exact kernel version ranges are not specified in available data; administrators should verify F2FS kernel module version against these commit identifiers in their distribution's changelog.
RemediationAI
Update the Linux kernel to a version incorporating the four fix commits (25d2dc669f2a7e48b335d1cb07139f2ffc9fe5df, d625a2b08c089397d3a03bff13fa8645e4ec7a01, db489778e6f2a4034c2cd26fadda2796eba24dcd, eec1589be36fcf7440755703e4faeee2c01e360b), typically available in stable kernel releases following the upstream fix. Consult your Linux distribution's advisory and kernel changelog to identify the first patched version. As an interim mitigation, avoid concurrent fallocate operations on pinned F2FS files during active I/O workloads, or consider switching to an alternative filesystem (ext4, btrfs) if F2FS is not critical to your deployment. Verify kernel source commit history at https://git.kernel.org/stable/ to confirm patch inclusion in your target kernel version.
More in Linux Kernel
View allLinux kernel contains a flaw known as 'Dirty Pipe' where improper pipe buffer flag initialization allows unprivileged lo
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does no
The packet_set_ring function in net/packet/af_packet.c in the Linux kernel through 4.10.6 does not properly validate cer
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. Rated high severity (CVSS 7.0). Public ex
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr op
The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allo
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cau
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object ref
A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary
It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the h
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today