CVE ID : CVE-2025-40025<\/p>\n
Published : 28. Oktober 2025 10:15 | 29\u00a0Minuten ago<\/p>\n
Description : In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
f2fs: fix to do sanity check on node footer for non inode dnode<\/p>\n
As syzbot reported below:<\/p>\n
————[ cut here ]————
\nkernel BUG at fs\/f2fs\/file.c:1243!
\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
\nCPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full)
\nRIP: 0010:f2fs_truncate_hole+0x69e\/0x6c0 fs\/f2fs\/file.c:1243
\nCall Trace:<\/p>\n
f2fs_punch_hole+0x2db\/0x330 fs\/f2fs\/file.c:1306
\n f2fs_fallocate+0x546\/0x990 fs\/f2fs\/file.c:2018
\n vfs_fallocate+0x666\/0x7e0 fs\/open.c:342
\n ksys_fallocate fs\/open.c:366 [inline]\n __do_sys_fallocate fs\/open.c:371 [inline]\n __se_sys_fallocate fs\/open.c:369 [inline]\n __x64_sys_fallocate+0xc0\/0x110 fs\/open.c:369
\n do_syscall_x64 arch\/x86\/entry\/syscall_64.c:63 [inline]\n do_syscall_64+0xfa\/0x3b0 arch\/x86\/entry\/syscall_64.c:94
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f
\nRIP: 0033:0x7f1e65f8ebe9<\/p>\n
w\/ a fuzzed image, f2fs may encounter panic due to it detects inconsistent
\ntruncation range in direct node in f2fs_truncate_hole().<\/p>\n
The root cause is: a non-inode dnode may has the same footer.ino and
\nfooter.nid, so the dnode will be parsed as an inode, then ADDRS_PER_PAGE()
\nmay return wrong blkaddr count which may be 923 typically, by chance,
\ndn.ofs_in_node is equal to 923, then count can be calculated to 0 in below
\nstatement, later it will trigger panic w\/ f2fs_bug_on(, count == 0 || …).<\/p>\n
\tcount = min(end_offset – dn.ofs_in_node, pg_end – pg_start);<\/p>\n
This patch introduces a new node_type NODE_TYPE_NON_INODE, then allowing
\npassing the new_type to sanity_check_node_footer in f2fs_get_node_folio()
\nto detect corruption that a non-inode dnode has the same footer.ino and
\nfooter.nid.<\/p>\n
Scripts to reproduce:
\nmkfs.f2fs -f \/dev\/vdb
\nmount \/dev\/vdb \/mnt\/f2fs
\ntouch \/mnt\/f2fs\/foo
\ntouch \/mnt\/f2fs\/bar
\ndd if=\/dev\/zero of=\/mnt\/f2fs\/foo bs=1M count=8
\numount \/mnt\/f2fs
\ninject.f2fs –node –mb i_nid –nid 4 –idx 0 –val 5 \/dev\/vdb
\nmount \/dev\/vdb \/mnt\/f2fs
\nxfs_io \/mnt\/f2fs\/foo -c “fpunch 6984k 4k”<\/p>\n
Severity: 0.0 | NA<\/p>\n
Visit the link for more details, such as CVSS details, affected products, timeline, and more…\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"
CVE ID : CVE-2025-40025 Published : 28. Oktober 2025 10:15 | 29\u00a0Minuten ago Description : In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer for non inode dnode As syzbot reported below: ————[ cut here ]———— kernel BUG at fs\/f2fs\/file.c:1243! Oops: invalid opcode: 0000 [#1] …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-72505","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/72505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=72505"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/72505\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=72505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=72505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=72505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}