Cloudanix VulnDB

CVE-2023-54151

None

CVSS

—

EPSS

0.2%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux file-system code can make the whole computer crash when certain full-disk write patterns occur, requiring an operating-system update to prevent the problem.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Triggers a kernel panic in f2fs when checkpointing during foreground GC in LFS mode because dirty node and dentry pages from data migration can exhaust available free sections.

Why it matters to the business

Unexpected system crashes and reboots on affected Linux kernels using f2fs in LFS mode under heavy write workloads, leading to downtime and potential service interruption; the issue has been public for over 300 days with no known active exploitation campaigns.

How an attack unfolds

An attacker with local access crafts a scenario that fills an f2fs volume formatted in LFS mode, then performs sustained random writes that force foreground GC and checkpointing; when dirty metadata exceeds remaining free sections the kernel hits an assertion failure in new_curseg and crashes.

How to fix it

Upgrade the Linux kernel to a version containing commit f4631d295ae3fff9e240ab78dc17f4b83d14f7bc (or the equivalent fix in 75079c3d3cf376381489b9a82ee46c69024e1a15 for downstream trees) and reboot. Until patches are applied, avoid LFS mode on f2fs volumes that may become full.

How to confirm the fix worked

Confirm the running kernel contains the fix commit, then attempt to reproduce the original crash sequence on a test volume; absence of the panic and successful checkpointing under the described workload validates the remediation.

Typical attack path

  1. Format and mount an f2fs filesystem in LFS mode on a block device
  2. Write data until the volume is nearly full
  3. Perform continuous 4 KiB random writes across the file range to generate dirty node and dentry pages during GC
  4. Trigger foreground garbage collection that attempts a checkpoint with insufficient free sections
  5. Kernel panics in new_curseg when free-section checks fail

How to detect it

Search kernel logs and dmesg for f2fs stack traces containing new_curseg, allocate_segment_by_default, f2fs_write_checkpoint, or f2fs_gc around the time of unexpected reboots; correlate with prior f2fs mount options showing LFS mode and near-full volumes.

What your security team should do

  • Prioritize kernel updates on all systems using f2fs in LFS mode
  • Audit f2fs mount options and migrate away from LFS mode where feasible
  • Monitor kernel logs for f2fs checkpoint or new_curseg failures as an early indicator of exposure

The record

In the Linux kernel, the following vulnerability has been resolved: f2fs: Fix system crash due to lack of free space in LFS When f2fs tries to checkpoint during foreground gc in LFS mode, system crash occurs due to lack of free space if the amount of dirty node and dentry pages generated by data migration exceeds free space. The reproduction sequence is as follows. - 20GiB capacity block device (null_blk) - format and mount with LFS mode - create a file and write 20,000MiB - 4k random write on full range of the file RIP: 0010:new_curseg+0x48a/0x510 [f2fs] Code: 55 e7 f5 89 c0 48 0f af c3 48 8b 5d c0 48 c1 e8 20 83 c0 01 89 43 6c 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc <0f> 0b f0 41 80 4f 48 04 45 85 f6 0f 84 ba fd ff ff e9 ef fe ff ff RSP: 0018:ffff977bc397b218 EFLAGS: 00010246 RAX: 00000000000027b9 RBX: 0000000000000000 RCX: 00000000000027c0 RDX: 0000000000000000 RSI: 00000000000027b9 RDI: ffff8c25ab4e74f8 RBP: ffff977bc397b268 R08: 00000000000027b9 R09: ffff8c29e4a34b40 R10: 0000000000000001 R11: ffff977bc397b0d8 R12: 0000000000000000 R13: ffff8c25b4dd81a0 R14: 0000000000000000 R15: ffff8c2f667f9000 FS: 0000000000000000(0000) GS:ffff8c344ec80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c00055d000 CR3: 0000000e30810003 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> allocate_segment_by_default+0x9c/0x110 [f2fs] f2fs_allocate_data_block+0x243/0xa30 [f2fs] ? __mod_lruvec_page_state+0xa0/0x150 do_write_page+0x80/0x160 [f2fs] f2fs_do_write_node_page+0x32/0x50 [f2fs] __write_node_page+0x339/0x730 [f2fs] f2fs_sync_node_pages+0x5a6/0x780 [f2fs] block_operations+0x257/0x340 [f2fs] f2fs_write_checkpoint+0x102/0x1050 [f2fs] f2fs_gc+0x27c/0x630 [f2fs] ? folio_mark_dirty+0x36/0x70 f2fs_balance_fs+0x16f/0x180 [f2fs] This patch adds checking whether free sections are enough before checkpoint during gc. [Jaegeuk Kim: code clean-up]

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 6.1.30
Linux Kernel 5.19.0 6.1.30

Related vulnerabilities