CVE-2024-56565

What it actually does

The flaw causes a kernel panic in f2fs when discard_max_bytes is updated to zero after an LVM snapshot is created on a mounted device; __submit_discard_cmd then passes a zero nr_sects value to __blkdev_issue_discard, returning a NULL bio and triggering the warning at segment.c:1330.

Why it matters to the business

Systems running f2fs on LVM volumes risk sudden kernel crashes and loss of availability during routine snapshot operations, potentially disrupting services that rely on snapshot-based backups or thin provisioning.

How an attack unfolds

An attacker with local privileges performs writes and deletes on an f2fs filesystem mounted from an LVM logical volume, then creates an LVM snapshot; this updates discard parameters and causes the background discard thread to submit invalid commands, resulting in a panic.

How to fix it

Upgrade the Linux kernel to a version containing commit ed24ab98242f8d22b66fbe0452c97751b5ea4e22 or later; the patch drops all pending discards in f2fs_unfreeze when a snapshot is detected and adds a discard_max_bytes check before submission.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit; reproduce the provided test case (pvcreate, lvcreate, mount, file operations, snapshot creation) and verify no WARNING or panic occurs in __submit_discard_cmd.

Typical attack path

1. Create and mount an f2fs filesystem on an LVM logical volume
2. Write and delete files to queue discard commands
3. Create an LVM snapshot of the volume
4. Allow the f2fs issue_discard_thread to run and trigger the NULL bio dereference

How to detect it

Search kernel logs for the string __submit_discard_cmd and the call trace containing issue_discard_thread around the time LVM snapshot creation commands appear in audit or system logs.

What your security team should do

• Prioritize kernel updates on any hosts using f2fs with LVM snapshots
• Temporarily disable background discard or avoid snapshot creation on f2fs volumes until patched
• Add monitoring for f2fs discard-related kernel warnings in system logs