CVE-2025-38347

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Jul 10, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of certain filesystem metadata can cause the system to freeze when local programs try to create files on a specially crafted storage volume.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: Low
Impact: Denial Of Service
Component: OS kernel
Class: Improper Input Validation
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Missing sanity check allows xattr_nid to equal i_ino in f2fs inodes, causing __get_node_page to attempt a second lock on an already-held inode page during xattr/acl operations in f2fs_mknod, f2fs_add_inline_entry and related paths, resulting in deadlock.

Why it matters to the business

Local processes can hang indefinitely on affected filesystems, producing system-wide unresponsiveness, forced reboots, and operational disruption; urgency is elevated by ongoing Linux kernel exploitation campaigns and the need to apply updates before the listed CISA-style deadlines in downstream distributions.

How an attack unfolds

An attacker with local access supplies or triggers a crafted f2fs image containing an inode whose xattr_nid matches its own ino; subsequent directory operations such as mknod or bind on a unix socket invoke the ACL/xattr code path that re-acquires the same inode page lock, deadlocking the task and potentially the system. Threat actors listed in September 2025 active campaigns and privilege-escalation clusters have targeted similar kernel inode-handling flaws.

How to fix it

Upgrade linux-lts packages to the fixed versions: 6.1.81-r0 (Alpaquita 23), 6.6.58-r0 and 6.12.41-r0 (Alpaquita stream), or apply commit 44e904a1ad09e84039058dcbbb1b9ea5b8d7d75d in the stable kernel tree; rebuild and reboot into the patched kernel; consider mounting f2fs with stricter validation options until patches are deployed.

How to confirm the fix worked

Confirm the running kernel contains commit 44e904a1ad09 or the listed package versions; create test inodes with matching ino/xnid values and verify that f2fs_getxattr and f2fs_init_acl now reject the malformed metadata instead of deadlocking.

Typical attack path

Mount a malicious or corrupted f2fs filesystem
Perform filesystem operations that create or modify inodes (mknod, bind, mkdir) inside a directory with extended attributes
Trigger lookup_all_xattrs -> __get_node_page on the same inode whose xattr_nid == i_ino
Second folio_lock attempt blocks forever on the already-held page

How to detect it

Search kernel logs for repeated schedule+folio_wait_bit_common traces involving f2fs node.c or xattr.c; look for processes stuck in D-state during f2fs_mknod or unix_bind on f2fs mounts; examine f2fs image dumps for inodes where i_xattr_nid equals i_ino.

What your security team should do

Immediately schedule kernel upgrades to the exact fixed versions listed for each distribution
Prioritize systems exposing f2fs mounts to untrusted local users or containers
Add kernel version checks to vulnerability scanners and asset inventories
Monitor for hung f2fs tasks and enable hung_task_panic only after testing
Review f2fs usage in production images and replace with ext4 or xfs where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor140 state:D stack:24016 pid:5308 tgid:5308 ppid:5306 task_flags:0x400140 flags:0x00000006 Call Trace: <TASK> context_switch kernel/sched/core.c:5378 [inline] __schedule+0x190e/0x4c90 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 io_schedule+0x8d/0x110 kernel/sched/core.c:7690 folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317 __folio_lock mm/filemap.c:1664 [inline] folio_lock include/linux/pagemap.h:1163 [inline] __filemap_get_folio+0x147/0xb40 mm/filemap.c:1917 pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87 find_get_page_flags include/linux/pagemap.h:842 [inline] f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776 __get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463 read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306 lookup_all_xattrs fs/f2fs/xattr.c:355 [inline] f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533 __f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179 f2fs_acl_create fs/f2fs/acl.c:375 [inline] f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418 f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539 f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666 f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765 f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808 f2fs_add_link fs/f2fs/f2fs.h:3616 [inline] f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766 vfs_mknod+0x36d/0x3b0 fs/namei.c:4191 unix_bind_bsd net/unix/af_unix.c:1286 [inline] unix_bind+0x563/0xe30 net/unix/af_unix.c:1379 __sys_bind_socket net/socket.c:1817 [inline] __sys_bind+0x1e4/0x290 net/socket.c:1848 __do_sys_bind net/socket.c:1853 [inline] __se_sys_bind net/socket.c:1851 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1851 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Let's dump and check metadata of corrupted inode, it shows its xattr_nid is the same to its i_ino. dump.f2fs -i 3 chaseyu.img.raw i_xattr_nid [0x 3 : 3] So that, during mknod in the corrupted directory, it tries to get and lock inode page twice, result in deadlock. - f2fs_mknod - f2fs_add_inline_entry - f2fs_get_inode_page --- lock dir's inode page - f2fs_init_acl - f2fs_acl_create(dir,..) - __f2fs_get_acl - f2fs_getxattr - lookup_all_xattrs - __get_node_page --- try to lock dir's inode page In order to fix this, let's add sanity check on ino and xnid.

Affected packages

Ecosystem	Package	Introduced	Fixed
Debian:11	linux	0	No fix
Debian:12	linux	0	No fix
Debian:13	linux	0	6.12.35-1
Debian:14	linux	0	6.12.35-1
Linux	Kernel	3.8.0	5.4.297
Mageia:9	kernel	0	6.6.101-1.mga9
Mageia:9	kernel-linus	0	6.6.101-1.mga9
Mageia:9	kmod-virtualbox	0	7.1.10-7.mga9
Mageia:9	kmod-xtables-addons	0	3.24-83.mga9
Mageia:9	wireless-regdb	0	20250710-1.mga9