CVE-2025-23130

What it actually does

Race condition in f2fs pinfile fallocation allows concurrent allocations to exhaust free sections, triggering a kernel BUG/panic in get_new_segment/new_curseg when reclaim fails.

Why it matters to the business

Local users on f2fs-based systems can trigger kernel panics causing denial of service, system crashes, and operational downtime; low exploitability but high impact on affected Linux deployments.

How an attack unfolds

A local attacker issues concurrent fallocate syscalls targeting pinned files on f2fs to deplete free sections; the missing pin_sem coverage around f2fs_gc allows the allocator to reach get_new_segment without sufficient space, hitting the BUG.

How to fix it

Apply the kernel fix that widens pin_sem to cover f2fs_gc and improves error handling in get_new_segment/new_curseg; upgrade affected packages to the listed fixed versions such as ruby 3.1.2-142.module+el8.8.0+22637+76cde83a and related gems on RHEL 8.8 EUS.

How to confirm the fix worked

Confirm kernel version contains the f2fs segment.c changes; verify no BUG at fs/f2fs/segment.c:2746 under concurrent pinfile fallocate workloads; check package versions match the provided fixed module streams.

Typical attack path

1. Obtain local unprivileged access on an f2fs filesystem
2. Issue concurrent f2fs_fallocate calls on pinfiles
3. Exhaust free sections before GC reclaims space
4. Trigger kernel BUG at segment.c:2746 resulting in panic

How to detect it

Search kernel logs for BUG at fs/f2fs/segment.c:2746 or new_curseg calls; look for f2fs_allocate_pinning_section and f2fs_fallocate sequences under high concurrency; no remote indicators expected.

What your security team should do

• Prioritize patching f2fs systems to the fixed kernel versions
• Restrict unprivileged local access on f2fs volumes until patched
• Monitor for kernel oops/panics referencing f2fs/segment.c
• Test fallocate-heavy workloads after upgrade