CVE-2025-38218

What it actually does

Missing sanity check on sit_bitmap_size in f2fs allows out-of-bounds access during build_sit_entries when mounting a resized image with inconsistent MAIN_SEGS and bitmap metadata, triggering f2fs_bug_on and kernel panic.

Why it matters to the business

Systems using f2fs filesystems can experience sudden crashes and reboots when mounting specially crafted or corrupted images, leading to downtime, data access loss, and operational disruption; high ecosystem prevalence increases exposure across Linux distributions and dependent packages.

How an attack unfolds

An attacker generates a malformed f2fs image by performing an oversized resize operation that creates inconsistent sit bitmap metadata, then distributes or tricks a victim into mounting the image, causing the kernel to panic during segment manager initialization. Threat actors in Advanced Spyware Campaign and September 2025 Active Exploitation Campaigns have targeted similar Linux kernel flaws for privilege escalation or denial of service.

How to fix it

Upgrade affected packages to the fixed versions: nats (Chainguard) to 0.2.3-r2, nats (Wolfi) to 0.2.3-r2, and Linux kernel to commit 82f51bff393e4c12cf4de553120ca831cfa4ef19 or later stable releases containing the f2fs_sanity_check_ckpt addition.

How to confirm the fix worked

Confirm the patch is applied by verifying presence of the sanity check in f2fs_sanity_check_ckpt; test by attempting to mount known malformed resize images and ensuring no BUG or panic occurs; review kernel build logs for the updated commit.

Typical attack path

1. Create a large empty image file
2. Format it with mkfs.f2fs using a small segment count
3. Resize the image to a much larger size to produce inconsistent metadata
4. Distribute or coerce mounting of the resulting corrupted image
5. Trigger kernel panic on mount via f2fs_fill_super path

How to detect it

Search system logs for f2fs-related kernel panics or BUG entries at fs/f2fs/segment.h during mount operations; correlate with recent file system image handling or resize activity; review audit logs for mount syscalls on f2fs volumes from untrusted sources. Threat actor campaigns have shown interest in similar kernel paths for exploitation.

• kernel BUG at fs/f2fs/segment.h:863
• f2fs_ra_meta_pages
• f2fs_build_segment_manager
• sit_bitmap_size
• Oops: invalid opcode: 0000

What your security team should do

• Prioritize kernel and f2fs package updates on all Linux systems within the CISA-style remediation window if applicable
• Disable automatic mounting of untrusted f2fs images via mount options or policy
• Monitor for kernel oops and BUG reports referencing fs/f2fs/segment.h
• Audit f2fs usage in high-availability environments given downstream package prevalence