CVE-2025-40025— f2fs: fix to do sanity check on node footer for non inode dnode
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-40025
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
f2fs: fix to do sanity check on node footer for non inode dnode
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer for non inode dnode As syzbot reported below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/file.c:1243! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full) RIP: 0010:f2fs_truncate_hole+0x69e/0x6c0 fs/f2fs/file.c:1243 Call Trace: <TASK> f2fs_punch_hole+0x2db/0x330 fs/f2fs/file.c:1306 f2fs_fallocate+0x546/0x990 fs/f2fs/file.c:2018 vfs_fallocate+0x666/0x7e0 fs/open.c:342 ksys_fallocate fs/open.c:366 [inline] __do_sys_fallocate fs/open.c:371 [inline] __se_sys_fallocate fs/open.c:369 [inline] __x64_sys_fallocate+0xc0/0x110 fs/open.c:369 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1e65f8ebe9 w/ a fuzzed image, f2fs may encounter panic due to it detects inconsistent truncation range in direct node in f2fs_truncate_hole(). The root cause is: a non-inode dnode may has the same footer.ino and footer.nid, so the dnode will be parsed as an inode, then ADDRS_PER_PAGE() may return wrong blkaddr count which may be 923 typically, by chance, dn.ofs_in_node is equal to 923, then count can be calculated to 0 in below statement, later it will trigger panic w/ f2fs_bug_on(, count == 0 || ...). count = min(end_offset - dn.ofs_in_node, pg_end - pg_start); This patch introduces a new node_type NODE_TYPE_NON_INODE, then allowing passing the new_type to sanity_check_node_footer in f2fs_get_node_folio() to detect corruption that a non-inode dnode has the same footer.ino and footer.nid. Scripts to reproduce: mkfs.f2fs -f /dev/vdb mount /dev/vdb /mnt/f2fs touch /mnt/f2fs/foo touch /mnt/f2fs/bar dd if=/dev/zero of=/mnt/f2fs/foo bs=1M count=8 umount /mnt/f2fs inject.f2fs --node --mb i_nid --nid 4 --idx 0 --val 5 /dev/vdb mount /dev/vdb /mnt/f2fs xfs_io /mnt/f2fs/foo -c "fpunch 6984k 4k"
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于f2fs文件系统未对非inode dnode的节点页脚进行完整性检查，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-40025
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-40025
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-10-28 · 58 CVEs total
| CVE-2025-40064 | smc: Fix use-after-free in __pnet_find_base_ndev(). | |
| CVE-2025-40075 | tcp_metrics: use dst_dev_net_rcu() | |
| CVE-2025-40078 | bpf: Explicitly check accesses to bpf_sock_addr | |
| CVE-2025-40079 | riscv, bpf: Sign extend struct ops return values properly | |
| CVE-2025-40077 | f2fs: fix to avoid overflow while left shift operation | |
| CVE-2025-40081 | perf: arm_spe: Prevent overflow in PERF_IDX2OFF() | |
| CVE-2025-40068 | fs: ntfs3: Fix integer overflow in run_unpack() | |
| CVE-2025-40067 | fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist | |
| CVE-2025-40066 | wifi: mt76: mt7996: Check phy before init msta_link in mt7996_mac_sta_add_links() | |
| CVE-2025-40065 | RISC-V: KVM: Write hgatp register with valid mode bits | |
| CVE-2025-40069 | drm/msm: Fix obj leak in VM_BIND error path | |
| CVE-2025-40063 | crypto: comp - Use same definition of context alloc and free ops | |
| CVE-2025-40062 | crypto: hisilicon/qm - set NULL to qm->debug.qm_diff_regs | |
| CVE-2025-40061 | RDMA/rxe: Fix race in do_task() when draining | |
| CVE-2025-40060 | coresight: trbe: Return NULL pointer for allocation failures | |
| CVE-2025-40058 | iommu/vt-d: Disallow dirty tracking if incoherent page walk | |
| CVE-2025-40059 | coresight: Fix incorrect handling for return value of devm_kzalloc | |
| CVE-2025-40057 | ptp: Add a upper bound on max_vclocks | |
| CVE-2025-40056 | vhost: vringh: Fix copy_to_iter return value check | |
| CVE-2025-40055 | ocfs2: fix double free in user_cluster_connect() |
Showing top 20 of 58 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
Same vendor: Linux
- CVE-2026-46333
ptrace: slightly saner 'get_dumpable()' logic - CVE-2026-43490
ksmbd: validate inherited ACE SID length - CVE-2026-43489
liveupdate: luo_file: remember retrieve() status - CVE-2026-43487
ata: libata-core: Disable LPM on ST1000DM010-2EP102 - CVE-2026-43488
usb: xhci: Prevent interrupt storm on host controller error
V. Comments for CVE-2025-40025
No comments yet