CVE-2025-40150

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid migrating empty section

It reports a bug from device w/ zufs:

F2FS-fs (dm-64): Inconsistent segment (173822) type [1, 0] in SSA and SIT

F2FS-fs (dm-64): Stopped filesystem due to reason: 4

Thread A Thread B

- f2fs_expand_inode_data

- f2fs_allocate_pinning_section

- f2fs_gc_range

- do_garbage_collect w/ segno #x

- writepage

- f2fs_allocate_data_block

- new_curseg

- allocate segno #x

The root cause is: fallocate on pinning file may race w/ block allocation

as above, result in do_garbage_collect() from fallocate() may migrate

segment which is just allocated by a log, the log will update segment type

in its in-memory structure, however GC will get segment type from on-disk

SSA block, once segment type changes by log, we can detect such

inconsistency, then shutdown filesystem.

In this case, on-disk SSA shows type of segno #173822 is 1 (SUM_TYPE_NODE),

however segno

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References