CVE-2024-26871

What it actually does

Race condition allows io->bio to become NULL before a zone-end block address check, causing a NULL pointer dereference and kernel panic in f2fs_submit_page_write.

Why it matters to the business

Systems using the f2fs filesystem on zoned block devices can experience unexpected crashes and reboots during concurrent write operations, leading to downtime and potential data loss in storage-heavy workloads.

How an attack unfolds

An attacker with local access triggers concurrent write operations that race to submit I/O structures; when the race window allows io->bio to be cleared before the zone-end check, the kernel dereferences NULL and crashes. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Update the Linux kernel to a version containing commit 8e2ea8b04cb8d976110c4568509e67d6a39b2889 or later; rebuild and deploy the patched kernel across all affected hosts.

How to confirm the fix worked

Verify the running kernel source contains commit 8e2ea8b04cb8d976110c4568509e67d6a39b2889; attempt to reproduce the original race under load and confirm absence of NULL dereference oops in dmesg.

Typical attack path

1. Obtain local code execution on a Linux system using f2fs on zoned storage
2. Launch multiple concurrent write threads targeting zone-end block addresses
3. Time the writes to hit the window where another thread submits the bio
4. Trigger the NULL dereference in f2fs_submit_page_write resulting in kernel panic

How to detect it

Search kernel logs for BUG: kernel NULL pointer dereference messages with RIP pointing to f2fs_submit_page_write and stack traces containing f2fs_write_cache_pages or f2fs_do_write_data_page; correlate with high-concurrency write activity on f2fs mounts using zoned devices.

What your security team should do

• Prioritize kernel upgrade on all f2fs deployments within the next maintenance window
• Monitor for kernel oops reports referencing f2fs_submit_page_write
• Test the patched kernel in a staging environment with zoned storage workloads before production rollout