In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on sbi->totalvalidblock_count
syzbot reported a f2fs bug as below:
------------[ cut here ]------------ kernel BUG at fs/f2fs/f2fs.h:2521! RIP: 0010:decvalidblockcount+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521 Call Trace: f2fstruncatedatablocksrange+0xc8c/0x11a0 fs/f2fs/file.c:695 truncatednode+0x417/0x740 fs/f2fs/node.c:973 truncatenodes+0x3ec/0xf50 fs/f2fs/node.c:1014 f2fstruncateinodeblocks+0x8e3/0x1370 fs/f2fs/node.c:1197 f2fsdotruncateblocks+0x840/0x12b0 fs/f2fs/file.c:810 f2fstruncateblocks+0x10d/0x300 fs/f2fs/file.c:838 f2fstruncate+0x417/0x720 fs/f2fs/file.c:888 f2fssetattr+0xc4f/0x12f0 fs/f2fs/file.c:1112 notifychange+0xbca/0xe90 fs/attr.c:552 dotruncate+0x222/0x310 fs/open.c:65 handletruncate fs/namei.c:3466 [inline] doopen fs/namei.c:3849 [inline] pathopenat+0x2e4f/0x35d0 fs/namei.c:4004 dofilpopen+0x284/0x4e0 fs/namei.c:4031 dosysopenat2+0x12b/0x1d0 fs/open.c:1429 dosysopen fs/open.c:1444 [inline] _dosyscreat fs/open.c:1522 [inline] _sesyscreat fs/open.c:1516 [inline] _x64syscreat+0x124/0x170 fs/open.c:1516 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
The reason is: in fuzzed image, sbi->totalvalidblock_count is inconsistent w/ mapped blocks indexed by inode, so, we should not trigger panic for such case, instead, let's print log and set fsck flag.
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"44721477264232907832948572401447173418",
"57920155886261712754116006841540742007",
"152101603358212769950214078255404578268",
"36733708645388985387738168784974395843",
"313974830139070770514802004812071430535"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccc28c0397f75a3ec9539cceed9db014d7b73869",
"id": "CVE-2025-38163-1fe885d7",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "139644813343794283200669889139515274937",
"length": 846.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49bc7bf38e42cfa642787e947f5721696ea73ac3",
"id": "CVE-2025-38163-59b2e415",
"signature_type": "Function",
"target": {
"function": "dec_valid_block_count",
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"44721477264232907832948572401447173418",
"57920155886261712754116006841540742007",
"152101603358212769950214078255404578268",
"36733708645388985387738168784974395843",
"313974830139070770514802004812071430535"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a39cc43efc1bca74ed9d6cf9e60b995071f7d178",
"id": "CVE-2025-38163-883fc5be",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"44721477264232907832948572401447173418",
"57920155886261712754116006841540742007",
"152101603358212769950214078255404578268",
"36733708645388985387738168784974395843",
"313974830139070770514802004812071430535"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1b743c1955151bd392539b739a3ad155296be13",
"id": "CVE-2025-38163-8912f266",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "139644813343794283200669889139515274937",
"length": 846.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25f3776b58c1c45ad2e50ab4b263505b4d2378ca",
"id": "CVE-2025-38163-89214bdf",
"signature_type": "Function",
"target": {
"function": "dec_valid_block_count",
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "139644813343794283200669889139515274937",
"length": 846.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ccc28c0397f75a3ec9539cceed9db014d7b73869",
"id": "CVE-2025-38163-9fb5c459",
"signature_type": "Function",
"target": {
"function": "dec_valid_block_count",
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "139644813343794283200669889139515274937",
"length": 846.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1b743c1955151bd392539b739a3ad155296be13",
"id": "CVE-2025-38163-a1522b0c",
"signature_type": "Function",
"target": {
"function": "dec_valid_block_count",
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"44721477264232907832948572401447173418",
"57920155886261712754116006841540742007",
"152101603358212769950214078255404578268",
"36733708645388985387738168784974395843",
"313974830139070770514802004812071430535"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05872a167c2cab80ef186ef23cc34a6776a1a30c",
"id": "CVE-2025-38163-cc05951a",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "139644813343794283200669889139515274937",
"length": 846.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a39cc43efc1bca74ed9d6cf9e60b995071f7d178",
"id": "CVE-2025-38163-dcf6a8b5",
"signature_type": "Function",
"target": {
"function": "dec_valid_block_count",
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"44721477264232907832948572401447173418",
"57920155886261712754116006841540742007",
"152101603358212769950214078255404578268",
"36733708645388985387738168784974395843",
"313974830139070770514802004812071430535"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25f3776b58c1c45ad2e50ab4b263505b4d2378ca",
"id": "CVE-2025-38163-e5f6182c",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"44721477264232907832948572401447173418",
"57920155886261712754116006841540742007",
"152101603358212769950214078255404578268",
"36733708645388985387738168784974395843",
"313974830139070770514802004812071430535"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49bc7bf38e42cfa642787e947f5721696ea73ac3",
"id": "CVE-2025-38163-e8b693c3",
"signature_type": "Line",
"target": {
"file": "fs/f2fs/f2fs.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "139644813343794283200669889139515274937",
"length": 846.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05872a167c2cab80ef186ef23cc34a6776a1a30c",
"id": "CVE-2025-38163-f29df7aa",
"signature_type": "Function",
"target": {
"function": "dec_valid_block_count",
"file": "fs/f2fs/f2fs.h"
}
}
]