Cloudanix VulnDB

CVE-2025-68796

None

CVSS

—

EPSS

0.2%

Published

Jan 13, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel handles certain file operations on F2FS filesystems can make the computer crash.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw allows insertion of a zero-sized extent into the F2FS extent cache in the error path of f2fs_zero_range, triggering a kernel BUG in __update_extent_tree_range at extent_cache.c:678.

Why it matters to the business

Systems using the F2FS filesystem may experience unexpected kernel crashes during file operations such as fallocate or zero-range, causing downtime, potential data corruption risks, and operational disruption; high ecosystem prevalence in Linux environments increases urgency for patching despite low exploit likelihood.

How an attack unfolds

An attacker with local access issues targeted fallocate or ioctl preallocate calls on an F2FS filesystem to reach the error path in f2fs_zero_range, inserting an invalid zero-sized extent that crashes the kernel; no named threat actors or ransomware campaigns are associated.

How to fix it

Update the Linux kernel to a version containing commit 9c07bd262c13ca922adad6e7613d48505f97f548 or later; apply the fix across all affected stable branches.

How to confirm the fix worked

Confirm the presence of commit 9c07bd262c13ca922adad6e7613d48505f97f548 in the kernel source; re-test fallocate and zero-range operations on F2FS to ensure no zero-sized extent BUG occurs.

Typical attack path

  1. Mount or access an F2FS filesystem
  2. Issue fallocate, zero-range, or related ioctl operations
  3. Trigger error condition inside f2fs_zero_range
  4. Insert zero-sized extent into cache
  5. Trigger BUG and kernel panic

How to detect it

Search kernel logs and oops reports for messages referencing __update_extent_tree_range, zero-sized extent, or the BUG at fs/f2fs/extent_cache.c:678; correlate with f2fs_zero_range or f2fs_fallocate call traces.

  • __update_extent_tree_range: extent len is zero
  • kernel BUG at fs/f2fs/extent_cache.c:678
  • f2fs_zero_range
  • f2fs_update_read_extent_cache_range

What your security team should do

  • Apply the kernel fix containing commit 9c07bd262c13ca922adad6e7613d48505f97f548 as soon as possible on F2FS-using systems
  • Monitor kernel logs for extent_cache.c BUG messages
  • Restrict untrusted local access to F2FS volumes until patched
  • Include F2FS extent cache checks in post-update validation testing

The record

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0] ------------[ cut here ]------------ kernel BUG at fs/f2fs/extent_cache.c:678! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__update_extent_tree_range+0x13bc/0x1500 fs/f2fs/extent_cache.c:678 Call Trace: <TASK> f2fs_update_read_extent_cache_range+0x192/0x3e0 fs/f2fs/extent_cache.c:1085 f2fs_do_zero_range fs/f2fs/file.c:1657 [inline] f2fs_zero_range+0x10c1/0x1580 fs/f2fs/file.c:1737 f2fs_fallocate+0x583/0x990 fs/f2fs/file.c:2030 vfs_fallocate+0x669/0x7e0 fs/open.c:342 ioctl_preallocate fs/ioctl.c:289 [inline] file_ioctl+0x611/0x780 fs/ioctl.c:-1 do_vfs_ioctl+0xb33/0x1430 fs/ioctl.c:576 __do_sys_ioctl fs/ioctl.c:595 [inline] __se_sys_ioctl+0x82/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f07bc58eec9 In error path of f2fs_zero_range(), it may add a zero-sized extent into extent cache, it should be avoided.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.7.0 5.10.248
Mageia:9 kernel 0 6.6.120-1.mga9
Mageia:9 kernel-linus 0 6.6.120-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.14-14.mga9
Mageia:9 kmod-xtables-addons 0 3.24-88.mga9

Related vulnerabilities