CVE-2024-34027

What it actually does

Race condition in f2fs compression allows {reserve,release}_compress_blocks() to execute without cp_rwsem protection, permitting concurrent checkpoint operations that corrupt dnode blkaddr, inode fields, and total_valid_block_count metadata.

Why it matters to the business

Unexpected power loss on affected Linux systems using f2fs with compression can result in filesystem corruption, data loss, and potential system instability or downtime requiring recovery.

How an attack unfolds

An attacker with local access triggers concurrent compression block reservation/release operations while a checkpoint is in progress; on sudden power-off the unprotected metadata updates leave the filesystem in an inconsistent state that manifests after reboot.

How to fix it

Update the Linux kernel to a version containing commit a6e1f7744e9b84f86a629a76024bba8468aa153b or later; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel includes commit a6e1f7744e9b84f86a629a76024bba8468aa153b via git log or uname; test f2fs compression workloads with simulated power-loss scenarios to verify no metadata corruption occurs.

Typical attack path

1. Obtain local access on a system using f2fs with compression enabled
2. Trigger concurrent reserve/release_compress_blocks calls
3. Induce or wait for a checkpoint operation to interleave
4. Cause sudden power loss (SPO) during the race window
5. Reboot and observe metadata corruption affecting file integrity

How to detect it

Review kernel logs for f2fs checkpoint and compression related warnings around the time of unexpected shutdowns; inspect dnode and inode structures for inconsistent blkaddr values after recovery.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all production f2fs systems within the next maintenance window
• Monitor for f2fs filesystem errors in dmesg and fsck reports post-upgrade
• Disable f2fs compression temporarily on high-risk systems if immediate patching is delayed