CVE-2024-35844

What it actually does

Incorrect reserved_cblocks accounting in f2fs compression path when ENOSPC occurs on files using a single direct_node; the reserved_blocks counter is not updated after the error return, leaving the on-disk state inconsistent and preventing the fsck repair flag from being set.

Why it matters to the business

Compressed files on f2fs filesystems can become permanently unrepairable after low-space conditions, forcing manual intervention, potential data loss, or full filesystem checks that disrupt operations on embedded, mobile, or storage-heavy Linux deployments.

How an attack unfolds

An attacker or routine workload fills the filesystem while a compressed file is being manipulated; the subsequent reserve_cblocks ioctl fails without updating metadata, leaving the file in a state that survives reboot only if fsck is manually triggered, otherwise rendering the file inaccessible after the next mount.

How to fix it

Upgrade the Linux kernel to a version containing commit fa3ac8b1a227d9b470b87972494293348b5839ee or later; rebuild and deploy the updated kernel across all affected systems; schedule fsck on next boot for volumes that may already contain affected files.

How to confirm the fix worked

Confirm the running kernel contains fa3ac8b1a227d9b470b87972494293348b5839ee; attempt the reserve_cblocks operation under low-space conditions and verify the fsck flag is now correctly set on failure; inspect dmesg or kernel logs for the updated error path.

Typical attack path

1. Create or open a compressed file requiring only one direct_node on a near-full f2fs volume
2. Trigger release_cblocks or other compression operations that succeed
3. Fill remaining space with unrelated writes to force ENOSPC on reserve_cblocks
4. Observe the ioctl failure and the failure to increment reserved_blocks
5. Reboot; without the fsck flag the file remains unrepairable on next mount

How to detect it

Search kernel logs and dmesg for f2fs compression-related ENOSPC failures around the time of low-space events; look for files that remain inaccessible or show zero reserved blocks after reserve_cblocks calls fail; examine f2fs fsck reports for missing repair flags on compressed inodes.

What your security team should do

• Prioritize kernel updates on all systems using f2fs compression within the next maintenance window
• Enable periodic fsck on f2fs volumes that have experienced ENOSPC events
• Monitor for low free-space conditions on f2fs mounts and alert before reaching critical thresholds
• Review backup coverage for compressed files on f2fs filesystems