CVE-2025-38164

What it actually does

The flaw allows f2fs_gc_range() to attempt block migration on an opened section whose SSA summary data remains cached in curseg, producing SIT/SSA type inconsistency that triggers f2fs_handle_critical_error and stops the filesystem.

Why it matters to the business

Systems using f2fs on zoned block devices can experience sudden, unrecoverable filesystem shutdown during ordinary file allocation operations, resulting in service outages and potential data inaccessibility until the volume is repaired or replaced.

How an attack unfolds

A local user creates a pinned file on an f2fs zoned mount, performs a large fallocate, and causes the garbage collector to select a section still referenced by cached curseg summaries, hitting the inconsistency check and halting the filesystem.

How to fix it

Update to a kernel containing commit 44a51592ac657d8e422585414d7ec17a5b50fb0e or later; rebuild and reboot all affected hosts. Until patches are applied, avoid f2fs on zoned devices or disable pinning/fallocate workloads that trigger garbage collection on open sections.

How to confirm the fix worked

Confirm the running kernel contains commit 44a51592ac657d8e422585414d7ec17a5b50fb0e via git describe or kernel version string; reproduce the original test case and verify that f2fs_handle_critical_error is no longer reached.

Typical attack path

1. Mount f2fs on a zoned null_blk or equivalent device with -m flag
2. Create a file and mark it pinned via f2fs_io
3. Issue fallocate requesting several GiB of space
4. f2fs_allocate_pinning_section invokes f2fs_gc_range on an opened section
5. SSA block for that section is not yet on media, producing type mismatch
6. Kernel logs critical error and stops the filesystem

How to detect it

Search kernel logs and dmesg for the strings "Inconsistent segment" and "Stopped filesystem due to reason: 4"; correlate with f2fs_gc_range and f2fs_allocate_pinning_section call traces on systems using zoned f2fs mounts.

• F2FS-fs.*Inconsistent segment.*type.*in SSA and SIT
• F2FS-fs.*Stopped filesystem due to reason: 4
• f2fs_handle_critical_error.*do_garbage_collect

What your security team should do

• Prioritize patching all production hosts running f2fs on zoned storage within the next maintenance window
• Add kernel version checks to configuration management and CI pipelines
• Restrict untrusted local accounts from performing fallocate on f2fs mounts until patched
• Monitor for the exact error string "Inconsistent segment" in kernel logs