CVE-2024-27035

What it actually does

The flaw allows compressed data blocks in f2fs to be written without ensuring their associated metadata is persisted together during a checkpoint operation, so that after sudden power loss the on-disk state can become inconsistent and the compressed data is lost or corrupted.

Why it matters to the business

Systems using f2fs with compression can silently lose user data after an unexpected power failure or crash, leading to application failures, data recovery costs, and potential compliance issues for organizations that rely on the file system.

How an attack unfolds

An attacker with the ability to trigger repeated power interruptions or crashes on a system using f2fs compression can cause the checkpoint to complete without all compressed blocks being durably written, resulting in data corruption after recovery.

How to fix it

Update the Linux kernel to the commit e54cce8137258a550b49cae45d09e024821fb28d or later stable releases that contain the fix; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit e54cce8137258a550b49cae45d09e024821fb28d by checking the kernel version string or git log; test by performing compressed writes followed by simulated sudden power loss and verifying data integrity after recovery.

Typical attack path

1. Gain local access or the ability to induce system crashes on a target using f2fs with compression enabled
2. Repeatedly force sudden power loss or kernel panics during active compressed writes
3. After reboot observe corrupted or missing files that were previously written under compression

How to detect it

Review system logs for f2fs checkpoint and compression related messages around the time of unexpected shutdowns; inspect affected f2fs file systems for files that report I/O errors or checksum mismatches after recovery from power loss.

What your security team should do

• Prioritize kernel upgrades on all systems that mount f2fs volumes with compression enabled
• If immediate patching is not possible, disable f2fs compression as a temporary mitigation
• Monitor vendor advisories for backported fixes in distribution kernels