CVE-2021-46982

What it actually does

Race condition between f2fs_prepare_compress_overwrite and truncate_setsize allows find_lock_page to return NULL after page deletion from page cache, triggering kernel BUG and panic during writeback of compressed f2fs data.

Why it matters to the business

Local users can trigger kernel crashes on systems using f2fs with compression enabled, causing denial of service, potential data corruption during writes, and requiring reboots that disrupt operations on affected Linux systems.

How an attack unfolds

An attacker with local access creates or modifies a compressed file on f2fs, then concurrently issues truncate operations while the kernel performs writeback via prepare_compress_overwrite; the race leaves a stale page reference, causing NULL dereference and panic in the writeback worker thread.

How to fix it

Update to a Linux kernel version containing the fix for this race condition in fs/f2fs/compress.c; rebuild and reboot systems using f2fs compression; disable f2fs compression as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Confirm kernel version includes the referenced commit resolving the truncate race in prepare_compress_overwrite; test by running pos_fsstress or equivalent concurrent truncate/write workloads on f2fs without observing the BUG at compress.c:1082.

Typical attack path

1. Mount f2fs filesystem with compression enabled
2. Create file and trigger compression via writes
3. Spawn concurrent threads performing truncate and overwrite/write operations
4. Trigger writeback to invoke prepare_compress_overwrite
5. Cause page cache deletion during the race window leading to kernel BUG

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for 'kernel BUG at fs/f2fs/compress.c:1082' and stack traces involving prepare_compress_overwrite, f2fs_write_cache_pages, and writeback; correlate with f2fs mount options showing compression and user activity involving truncate on compressed files.

What your security team should do

• Prioritize patching kernel on all systems using f2fs with compression
• Audit workloads for f2fs compression usage and schedule updates within maintenance windows
• Monitor kernel logs for f2fs compress-related BUGs as an interim detection measure
• Consider disabling compression on f2fs mounts if immediate patching is not feasible