Kernel Panic Vulnerability in Linux Packages Due to f2fs Metadata Corruption
Summary
CVE-2025-38218: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on sit_bitmap_size w/ below testcase, resize will generate a corrupted image which contains inconsistent metadata, so when... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the system and is known for its stability and performance. The f2fs (Flash-Friendly File System) is specifically designed for NAND flash memory storage. This vulnerability affects the f2fs implementation in the Linux kernel, where improper handling of metadata during resizing operations can lead to kernel panics, causing system instability.
Vulnerability Detail
The vulnerability, identified as CVE-2025-38218, arises from a lack of sanity checks on the sit_bitmap_size in the f2fs file system. When resizing a file system image, it can generate corrupted images with inconsistent metadata. This inconsistency can trigger a kernel panic upon mounting the affected image. Specifically, the issue occurs when the size of the sit bitmap does not match the expected number of sit blocks, leading to out-of-bounds access and potential system crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the resize.f2fs command on file system images until the patch is applied. If resizing is necessary, ensure that the image is created and managed in a way that does not lead to inconsistencies in the metadata.
Conclusion
CVE-2025-38218 is a critical vulnerability in the Linux kernel's f2fs file system that can lead to kernel panics due to improper metadata handling. Users are advised to update their systems to the latest patched versions to ensure stability and security. Temporary workarounds are available, but applying the patch is the best long-term solution.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38218 is a vulnerability in the Linux kernel's f2fs file system that can cause kernel panics due to corrupted metadata during resizing operations.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The primary risk is system instability, which can lead to crashes and data loss if the affected file system is mounted.
Yes, patches are available in the updated versions of the Linux kernel. Users should ensure they are running the latest version to mitigate this vulnerability.
If immediate updates are not possible, refrain from using the resize.f2fs command on affected file systems until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
