CVE-2025-40150

Vulnerability

Description CVE-2025-40150 is a race condition in the Linux kernel's f2fs filesystem. The bug occurs when fallocate() on a pinned file, which triggers garbage collection via f2fs_gc_range(), races with a concurrent block allocation (writepage → f2fs_allocate_data_block → new_curseg). This can cause garbage collection to migrate a segment that was just allocated by a log, leading to inconsistency between on-disk SSA (Segment Summary Area) and in-memory SIT (Segment Information Table) segment types [1][2].

Exploitation

An attacker with local access and the ability to trigger fallocate on pinned files while concurrent writes are occurring can exploit this race. No special permissions beyond file write access are required, but the race window is narrow. The vulnerability is inherent in the kernel's f2fs implementation and does not require network access.

Impact

Successful exploitation can cause the kernel to detect inconsistent segment types (e.g., on-disk SSA shows type 1 for node, in-memory SIT shows type 0 for data) and shut down the filesystem to prevent further corruption. This results in a denial of service (DoS), making the filesystem unavailable until manual repair is performed.

Mitigation

The fix includes checking whether the current section is empty before performing garbage collection, and adding sanity checks in do_garbage_collect() to prevent migrating segments in use by logs [1][2]. Linux kernel stable branches have received patches; users should update their kernels to versions containing commit d625a2b08c0893 or eec1589be36fcf [1][2].