CVE-2025-38164 (GCVE-0-2025-38164)
Vulnerability from cvelistv5
Published
2025-07-03 08:36
Modified
2025-07-28 04:13
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: zone: fix to avoid inconsistence in between SIT and SSA w/ below testcase, it will cause inconsistence in between SIT and SSA. create_null_blk 512 2 1024 1024 mkfs.f2fs -m /dev/nullb0 mount /dev/nullb0 /mnt/f2fs/ touch /mnt/f2fs/file f2fs_io pinfile set /mnt/f2fs/file fallocate -l 4GiB /mnt/f2fs/file F2FS-fs (nullb0): Inconsistent segment (0) type [1, 0] in SSA and SIT CPU: 5 UID: 0 PID: 2398 Comm: fallocate Tainted: G O 6.13.0-rc1 #84 Tainted: [O]=OOT_MODULE Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 Call Trace: <TASK> dump_stack_lvl+0xb3/0xd0 dump_stack+0x14/0x20 f2fs_handle_critical_error+0x18c/0x220 [f2fs] f2fs_stop_checkpoint+0x38/0x50 [f2fs] do_garbage_collect+0x674/0x6e0 [f2fs] f2fs_gc_range+0x12b/0x230 [f2fs] f2fs_allocate_pinning_section+0x5c/0x150 [f2fs] f2fs_expand_inode_data+0x1cc/0x3c0 [f2fs] f2fs_fallocate+0x3c3/0x410 [f2fs] vfs_fallocate+0x15f/0x4b0 __x64_sys_fallocate+0x4a/0x80 x64_sys_call+0x15e8/0x1b80 do_syscall_64+0x68/0x130 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f9dba5197ca F2FS-fs (nullb0): Stopped filesystem due to reason: 4 The reason is f2fs_gc_range() may try to migrate block in curseg, however, its SSA block is not uptodate due to the last summary block data is still in cache of curseg. In this patch, we add a condition in f2fs_gc_range() to check whether section is opened or not, and skip block migration for opened section.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9703d69d9d153bb230711d0d577454552aeb13d4
Version: 9703d69d9d153bb230711d0d577454552aeb13d4
Version: 9703d69d9d153bb230711d0d577454552aeb13d4
Version: 40d76c393cca83938b11eb7ca8983aa3cd0ed69b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/gc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44a51592ac657d8e422585414d7ec17a5b50fb0e",
              "status": "affected",
              "version": "9703d69d9d153bb230711d0d577454552aeb13d4",
              "versionType": "git"
            },
            {
              "lessThan": "8d9431b0d11a5030aa1ce477defee455b3821701",
              "status": "affected",
              "version": "9703d69d9d153bb230711d0d577454552aeb13d4",
              "versionType": "git"
            },
            {
              "lessThan": "773704c1ef96a8b70d0d186ab725f50548de82c4",
              "status": "affected",
              "version": "9703d69d9d153bb230711d0d577454552aeb13d4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "40d76c393cca83938b11eb7ca8983aa3cd0ed69b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/gc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: zone: fix to avoid inconsistence in between SIT and SSA\n\nw/ below testcase, it will cause inconsistence in between SIT and SSA.\n\ncreate_null_blk 512 2 1024 1024\nmkfs.f2fs -m /dev/nullb0\nmount /dev/nullb0 /mnt/f2fs/\ntouch /mnt/f2fs/file\nf2fs_io pinfile set /mnt/f2fs/file\nfallocate -l 4GiB /mnt/f2fs/file\n\nF2FS-fs (nullb0): Inconsistent segment (0) type [1, 0] in SSA and SIT\nCPU: 5 UID: 0 PID: 2398 Comm: fallocate Tainted: G           O       6.13.0-rc1 #84\nTainted: [O]=OOT_MODULE\nHardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xb3/0xd0\n dump_stack+0x14/0x20\n f2fs_handle_critical_error+0x18c/0x220 [f2fs]\n f2fs_stop_checkpoint+0x38/0x50 [f2fs]\n do_garbage_collect+0x674/0x6e0 [f2fs]\n f2fs_gc_range+0x12b/0x230 [f2fs]\n f2fs_allocate_pinning_section+0x5c/0x150 [f2fs]\n f2fs_expand_inode_data+0x1cc/0x3c0 [f2fs]\n f2fs_fallocate+0x3c3/0x410 [f2fs]\n vfs_fallocate+0x15f/0x4b0\n __x64_sys_fallocate+0x4a/0x80\n x64_sys_call+0x15e8/0x1b80\n do_syscall_64+0x68/0x130\n entry_SYSCALL_64_after_hwframe+0x67/0x6f\nRIP: 0033:0x7f9dba5197ca\nF2FS-fs (nullb0): Stopped filesystem due to reason: 4\n\nThe reason is f2fs_gc_range() may try to migrate block in curseg, however,\nits SSA block is not uptodate due to the last summary block data is still\nin cache of curseg.\n\nIn this patch, we add a condition in f2fs_gc_range() to check whether\nsection is opened or not, and skip block migration for opened section."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-28T04:13:57.750Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44a51592ac657d8e422585414d7ec17a5b50fb0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d9431b0d11a5030aa1ce477defee455b3821701"
        },
        {
          "url": "https://git.kernel.org/stable/c/773704c1ef96a8b70d0d186ab725f50548de82c4"
        }
      ],
      "title": "f2fs: zone: fix to avoid inconsistence in between SIT and SSA",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38164",
    "datePublished": "2025-07-03T08:36:05.017Z",
    "dateReserved": "2025-04-16T04:51:23.991Z",
    "dateUpdated": "2025-07-28T04:13:57.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38164\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:31.863\",\"lastModified\":\"2025-07-03T15:13:53.147\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nf2fs: zone: fix to avoid inconsistence in between SIT and SSA\\n\\nw/ below testcase, it will cause inconsistence in between SIT and SSA.\\n\\ncreate_null_blk 512 2 1024 1024\\nmkfs.f2fs -m /dev/nullb0\\nmount /dev/nullb0 /mnt/f2fs/\\ntouch /mnt/f2fs/file\\nf2fs_io pinfile set /mnt/f2fs/file\\nfallocate -l 4GiB /mnt/f2fs/file\\n\\nF2FS-fs (nullb0): Inconsistent segment (0) type [1, 0] in SSA and SIT\\nCPU: 5 UID: 0 PID: 2398 Comm: fallocate Tainted: G           O       6.13.0-rc1 #84\\nTainted: [O]=OOT_MODULE\\nHardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0xb3/0xd0\\n dump_stack+0x14/0x20\\n f2fs_handle_critical_error+0x18c/0x220 [f2fs]\\n f2fs_stop_checkpoint+0x38/0x50 [f2fs]\\n do_garbage_collect+0x674/0x6e0 [f2fs]\\n f2fs_gc_range+0x12b/0x230 [f2fs]\\n f2fs_allocate_pinning_section+0x5c/0x150 [f2fs]\\n f2fs_expand_inode_data+0x1cc/0x3c0 [f2fs]\\n f2fs_fallocate+0x3c3/0x410 [f2fs]\\n vfs_fallocate+0x15f/0x4b0\\n __x64_sys_fallocate+0x4a/0x80\\n x64_sys_call+0x15e8/0x1b80\\n do_syscall_64+0x68/0x130\\n entry_SYSCALL_64_after_hwframe+0x67/0x6f\\nRIP: 0033:0x7f9dba5197ca\\nF2FS-fs (nullb0): Stopped filesystem due to reason: 4\\n\\nThe reason is f2fs_gc_range() may try to migrate block in curseg, however,\\nits SSA block is not uptodate due to the last summary block data is still\\nin cache of curseg.\\n\\nIn this patch, we add a condition in f2fs_gc_range() to check whether\\nsection is opened or not, and skip block migration for opened section.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: zona: correcci\u00f3n para evitar inconsistencia entre SIT y SSA con el siguiente caso de prueba, provocar\u00e1 inconsistencia entre SIT y SSA. create_null_blk 512 2 1024 1024 mkfs.f2fs -m /dev/nullb0 mount /dev/nullb0 /mnt/f2fs/ touch /mnt/f2fs/file f2fs_io pinfile set /mnt/f2fs/file fallocate -l 4GiB /mnt/f2fs/file F2FS-fs (nullb0): Segmento inconsistente (0) tipo [1, 0] en SSA y SIT CPU: 5 UID: 0 PID: 2398 Comm: fallocate Contaminado: GO 6.13.0-rc1 #84 Contaminado: [O]=OOT_MODULE Nombre del hardware: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 Rastreo de llamadas  dump_stack_lvl+0xb3/0xd0 dump_stack+0x14/0x20 f2fs_handle_critical_error+0x18c/0x220 [f2fs] f2fs_stop_checkpoint+0x38/0x50 [f2fs] do_garbage_collect+0x674/0x6e0 [f2fs] f2fs_gc_range+0x12b/0x230 [f2fs] f2fs_allocate_pinning_section+0x5c/0x150 [f2fs] f2fs_expand_inode_data+0x1cc/0x3c0 [f2fs] f2fs_fallocate+0x3c3/0x410 [f2fs] vfs_fallocate+0x15f/0x4b0 __x64_sys_fallocate+0x4a/0x80 x64_sys_call+0x15e8/0x1b80 do_syscall_64+0x68/0x130 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f9dba5197ca F2FS-fs (nullb0): Sistema de archivos detenido por el motivo: 4. El motivo es que f2fs_gc_range() podr\u00eda intentar migrar un bloque en curseg; sin embargo, su bloque SSA no est\u00e1 actualizado debido a que los \u00faltimos datos del bloque de resumen a\u00fan se encuentran en la cach\u00e9 de curseg. En este parche, a\u00f1adimos una condici\u00f3n en f2fs_gc_range() para comprobar si la secci\u00f3n est\u00e1 abierta y omitir la migraci\u00f3n del bloque en la secci\u00f3n abierta.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/44a51592ac657d8e422585414d7ec17a5b50fb0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/773704c1ef96a8b70d0d186ab725f50548de82c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8d9431b0d11a5030aa1ce477defee455b3821701\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.