CVE-2024-53220

What it actually does

The flaw fails to correctly account for additional dirty data segments required when checkpoint_disabling and lfs_mode are both enabled, causing underestimation of consumed free segments and triggering a kernel BUG during new_curseg allocation after out-of-place writes.

Why it matters to the business

Systems running f2fs under the affected configuration modes may experience unexpected kernel panics during file writes and sync operations, leading to application crashes, potential data loss on affected mounts, and unplanned downtime; low urgency given no KEV listing, stable low EPSS, and over a year since publication with no widespread exploitation reported.

How an attack unfolds

An attacker with local access enables or triggers workloads using checkpoint_disabling plus lfs_mode, performs repeated overwrites that force out-of-place updates, exhausts unaccounted free segments during allocation, and triggers the panic path in f2fs_allocate_data_block; listed threat actors reference generic Linux kernel campaigns but none are confirmed exploiting this specific accounting error.

How to fix it

Upgrade the Linux kernel to a version containing the fix for f2fs dirty data accounting in __get_secs_required; apply the patch referenced in the commit that adds proper segment reservation before allocation when both modes are active.

How to confirm the fix worked

Confirm the kernel version contains the fix, reproduce the original testcase from the f2fs test suite under checkpoint_disabling+lfs_mode, and verify no BUG at segment.c:2752 occurs during f2fs_sync_file and writeback sequences.

Typical attack path

1. Obtain local code execution or shell on target system
2. Mount or configure f2fs with checkpoint_disabling and lfs_mode enabled
3. Generate heavy overwrite workloads that invoke OPU paths
4. Trigger fsync or writeback that calls f2fs_do_sync_file
5. Force segment allocation to exhaust unaccounted free segments and hit BUG

How to detect it

Search kernel logs for the exact BUG message at fs/f2fs/segment.c:2752 combined with the call trace containing f2fs_allocate_data_block, do_write_page, and f2fs_sync_file; review dmesg, journalctl, or /var/log/kern.log for f2fs segment exhaustion events on systems with the vulnerable mount options.

• kernel BUG at fs/f2fs/segment.c:2752
• new_curseg+0xc81/0x2110
• f2fs_allocate_data_block+0x1c91/0x4540
• f2fs_do_sync_file

What your security team should do

• Prioritize kernel upgrades on systems using f2fs with checkpoint disabling or LFS mode
• Audit f2fs mount options in production workloads for the risky combination
• Monitor for kernel oops or BUG reports containing new_curseg and f2fs_allocate_data_block
• Test patched kernels with fsstress or the linked fstests case before broad deployment