CVE-2025-38218

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on sit_bitmap_size

w/ below testcase, resize will generate a corrupted image which

contains inconsistent metadata, so when mounting such image, it

will trigger kernel panic:

touch img

truncate -s $((512*1024*1024*1024)) img

mkfs.f2fs -f img $((256*1024*1024))

resize.f2fs -s -i img -t $((1024*1024*1024))

mount img /mnt/f2fs

------------[ cut here ]------------

kernel BUG at fs/f2fs/segment.h:863!

Oops: invalid opcode: 0000 [#1] SMP PTI

CPU: 11 UID: 0 PID: 3922 Comm: mount Not tainted 6.15.0-rc1+ #191 PREEMPT(voluntary)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

RIP: 0010:f2fs_ra_meta_pages+0x47c/0x490

Call Trace:

f2fs_build_segment_manager+0x11c3/0x2600

f2fs_fill_super+0xe97/0x2840

mount_bdev+0xf4/0x140

legacy_get_tree+0x2b/0x50

vfs_get_tree+0x29/0xd0

path_mount+0x487/0xaf0

__x64_sys_mount+0x116/0x150

do_syscall_64+0x82/0x190

e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References