Critical Vulnerability in Linux Kernel: Inconsistent Node Truncation in f2fs
Summary
DEBIAN-CVE-2025-40025: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer for non inode dnode As syzbot reported below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/fil... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources and facilitates communication between software and hardware. The f2fs (Flash-Friendly File System) is designed for NAND flash memory, optimizing performance and longevity. However, it has been found to have a critical vulnerability that can lead to system crashes under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the f2fs file system that can cause a kernel panic when handling non-inode dnodes. Specifically, if a non-inode dnode has the same footer.ino and footer.nid, it may be incorrectly parsed as an inode, leading to an inconsistent truncation range. This inconsistency can trigger a panic due to a bug check in the f2fs_truncate_hole function, potentially resulting in system instability and data loss.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid using the f2fs file system until the patch is applied. If necessary, consider using an alternative file system that does not exhibit this vulnerability.
Conclusion
The vulnerability CVE-2025-40025 in the Linux kernel's f2fs file system poses a significant risk of system instability and data loss. Users are advised to update their systems to the latest patched version of the kernel to mitigate this risk. In the meantime, alternative file systems or workarounds should be considered.
See every vulnerability recorded for linux →
FAQ
CVE-2025-40025 is a vulnerability in the Linux kernel's f2fs file system that can lead to kernel panic due to inconsistent node truncation.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability can cause kernel panic, leading to system crashes and potential data loss, especially when handling certain file operations.
Yes, a patch has been released for the Linux kernel to address this vulnerability. Users should update their kernel to the latest version.
If an immediate update is not possible, consider using a different file system or avoiding operations that may trigger the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
