Cloudanix VulnDB

CVE-2025-38219

None

CVSS

—

EPSS

0.2%

Published

Jul 4, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of damaged file system images could cause warning messages or minor instability when deleting files on affected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Corrupted f2fs filesystem metadata can produce negative i_nlink values that trigger a kernel warning inside drop_nlink during unlink operations on affected Linux kernels.

Why it matters to the business

Systems using f2fs with untrusted images face potential kernel warnings that may lead to stability issues or require reboots; widespread Linux kernel exposure increases operational overhead for organizations relying on f2fs storage.

How an attack unfolds

An attacker supplies a specially crafted corrupted f2fs image, mounts it on a vulnerable kernel, and issues unlink syscalls that traverse f2fs_delete_entry and f2fs_drop_nlink, causing drop_nlink to emit a warning when the link count goes negative.

How to fix it

Upgrade Linux kernel to commit d9a55869d8237e677ddaa18b0f58586364cfbc1c or later; update Chainguard cfssl-fips, cfssl-bundle-fips, cfssl-certinfo-fips, cfssl-json-fips, cfssl-mkbundle-fips, cfssl-multirootca-fips, cfssl-newkey-fips, and cfssl-scan-fips packages to version 1.6.5-r12 or newer.

How to confirm the fix worked

Verify the running kernel contains commit d9a55869d8237e677ddaa18b0f58586364cfbc1c and confirm package versions match or exceed the listed fixed releases; reproduce the original warning scenario with a test corrupted image to ensure the warning no longer occurs.

Typical attack path

  1. Craft or obtain a malicious f2fs filesystem image containing invalid link counts
  2. Mount the image on a vulnerable Linux kernel
  3. Perform file or directory deletion operations via unlink or rmdir
  4. Trigger the warning path in drop_nlink through f2fs_i_links_write

How to detect it

Search kernel logs and dmesg output for the exact warning string originating from fs/inode.c:417 drop_nlink triggered via f2fs_delete_entry or f2fs_unlink call paths; correlate with mount and unlink activity on f2fs volumes.

  • WARNING: CPU: .* at fs/inode.c:417 drop_nlink
  • f2fs_i_links_write.*f2fs_drop_nlink.*f2fs_delete_entry
  • RIP: .*drop_nlink+0xac/0xd0

What your security team should do

  • Apply kernel and package updates immediately on all systems that mount f2fs volumes
  • Restrict mounting of untrusted or external f2fs images until patches are deployed
  • Monitor kernel logs for drop_nlink warnings on f2fs filesystems as a temporary detection measure

The record

In the Linux kernel, the following vulnerability has been resolved: f2fs: prevent kernel warning due to negative i_nlink from corrupted image WARNING: CPU: 1 PID: 9426 at fs/inode.c:417 drop_nlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Modules linked in: CPU: 1 UID: 0 PID: 9426 Comm: syz-executor568 Not tainted 6.14.0-12627-g94d471a4f428 #2 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:drop_nlink+0xac/0xd0 home/cc/linux/fs/inode.c:417 Code: 48 8b 5d 28 be 08 00 00 00 48 8d bb 70 07 00 00 e8 f9 67 e6 ff f0 48 ff 83 70 07 00 00 5b 5d e9 9a 12 82 ff e8 95 12 82 ff 90 &lt;0f&gt; 0b 90 c7 45 48 ff ff ff ff 5b 5d e9 83 12 82 ff e8 fe 5f e6 ff RSP: 0018:ffffc900026b7c28 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8239710f RDX: ffff888041345a00 RSI: ffffffff8239717b RDI: 0000000000000005 RBP: ffff888054509ad0 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: ffffffff9ab36f08 R12: ffff88804bb40000 R13: ffff8880545091e0 R14: 0000000000008000 R15: ffff8880545091e0 FS: 000055555d0c5880(0000) GS:ffff8880eb3e3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f915c55b178 CR3: 0000000050d20000 CR4: 0000000000352ef0 Call Trace: <task> f2fs_i_links_write home/cc/linux/fs/f2fs/f2fs.h:3194 [inline] f2fs_drop_nlink+0xd1/0x3c0 home/cc/linux/fs/f2fs/dir.c:845 f2fs_delete_entry+0x542/0x1450 home/cc/linux/fs/f2fs/dir.c:909 f2fs_unlink+0x45c/0x890 home/cc/linux/fs/f2fs/namei.c:581 vfs_unlink+0x2fb/0x9b0 home/cc/linux/fs/namei.c:4544 do_unlinkat+0x4c5/0x6a0 home/cc/linux/fs/namei.c:4608 __do_sys_unlink home/cc/linux/fs/namei.c:4654 [inline] __se_sys_unlink home/cc/linux/fs/namei.c:4652 [inline] __x64_sys_unlink+0xc5/0x110 home/cc/linux/fs/namei.c:4652 do_syscall_x64 home/cc/linux/arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc7/0x250 home/cc/linux/arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb3d092324b Code: 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 57 00 00 00 0f 05 &lt;48&gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdc232d938 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb3d092324b RDX: 00007ffdc232d960 RSI: 00007ffdc232d960 RDI: 00007ffdc232d9f0 RBP: 00007ffdc232d9f0 R08: 0000000000000001 R09: 00007ffdc232d7c0 R10: 00000000fffffffd R11: 0000000000000206 R12: 00007ffdc232eaf0 R13: 000055555d0cebb0 R14: 00007ffdc232d958 R15: 0000000000000001 </task>

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 No fix
Debian:14 linux 0 6.12.35-1
Linux Kernel 3.8.0 5.4.295
Mageia:9 kernel 0 6.6.101-1.mga9
Mageia:9 kernel-linus 0 6.6.101-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.10-7.mga9
Mageia:9 kmod-xtables-addons 0 3.24-83.mga9
Mageia:9 wireless-regdb 0 20250710-1.mga9

Related vulnerabilities