CVE-2025-38163 in Linux
Summary
by MITRE • 07/03/2025
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on sbi->total_valid_block_count
syzbot reported a f2fs bug as below:
------------[ cut here ]------------
kernel BUG at fs/f2fs/f2fs.h:2521! RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521 Call Trace: f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695 truncate_dnode+0x417/0x740 fs/f2fs/node.c:973 truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014 f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197 f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810 f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838 f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888 f2fs_setattr+0xc4f/0x12f0 fs/f2fs/file.c:1112 notify_change+0xbca/0xe90 fs/attr.c:552 do_truncate+0x222/0x310 fs/open.c:65 handle_truncate fs/namei.c:3466 [inline]
do_open fs/namei.c:3849 [inline]
path_openat+0x2e4f/0x35d0 fs/namei.c:4004 do_filp_open+0x284/0x4e0 fs/namei.c:4031 do_sys_openat2+0x12b/0x1d0 fs/open.c:1429 do_sys_open fs/open.c:1444 [inline]
__do_sys_creat fs/open.c:1522 [inline]
__se_sys_creat fs/open.c:1516 [inline]
__x64_sys_creat+0x124/0x170 fs/open.c:1516 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
The reason is: in fuzzed image, sbi->total_valid_block_count is inconsistent w/ mapped blocks indexed by inode, so, we should not trigger panic for such case, instead, let's print log and set fsck flag.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/18/2026
The vulnerability CVE-2025-38163 affects the Linux kernel's F2FS (Flash-Friendly File System) implementation and represents a critical stability issue that can lead to system crashes through improper validation of block count consistency. This flaw manifests when the filesystem encounters inconsistent state between the superblock's total valid block count and the actual mapped blocks indexed by inodes during file truncation operations. The issue was identified through automated fuzzing conducted by syzbot, which revealed a kernel BUG triggered at line 2521 in fs/f2fs/f2fs.h, specifically within the dec_valid_block_count function. The call trace demonstrates the cascading effect of this issue through multiple filesystem operations including truncate, setattr, and file opening routines, indicating the vulnerability can be exploited during normal file system operations.
The technical root cause of this vulnerability stems from inadequate sanity checking within the F2FS subsystem's block accounting mechanism. When processing file truncation requests, the kernel performs validation between sbi->total_valid_block_count and inode-mapped blocks, but fails to properly handle cases where these values become inconsistent due to corrupted or malformed filesystem images. This inconsistency triggers an immediate kernel panic rather than implementing proper error handling, leading to system instability and potential denial of service. According to CWE classification, this vulnerability maps to CWE-617: "Reachable Assertion" and CWE-248: "Uncaught Exception," as the system fails to properly handle exceptional conditions during filesystem operations. The ATT&CK framework would categorize this under T1490: "Inhibit System Recovery" due to the panic condition that prevents normal system operation.
The operational impact of CVE-2025-38163 extends beyond simple system crashes to potentially compromise data integrity and availability in systems utilizing F2FS filesystems. When triggered, the vulnerability causes immediate kernel panics that require system reboot, disrupting ongoing operations and potentially leading to data loss if transactions are not properly committed. The vulnerability affects systems where F2FS is the primary filesystem, including embedded devices, mobile platforms, and servers that rely on flash-based storage. The issue becomes particularly concerning in environments where filesystem corruption can occur due to power failures, hardware malfunctions, or malicious input, as the panic condition prevents normal filesystem recovery mechanisms from functioning. Organizations running F2FS-based systems should consider this vulnerability as a high-priority concern requiring immediate patching to prevent potential service disruptions.
Mitigation strategies for CVE-2025-38163 focus on implementing proper error handling rather than system panics when block count inconsistencies are detected. The fix involves modifying the F2FS implementation to log warning messages and set filesystem check flags instead of immediately panicking when inconsistencies are found between sbi->total_valid_block_count and inode-mapped blocks. System administrators should prioritize applying kernel updates containing the patched F2FS implementation, which typically includes enhanced validation routines and proper error propagation mechanisms. Additionally, organizations should implement regular filesystem integrity checks and monitoring systems to detect early signs of filesystem corruption that might lead to this vulnerability being triggered. The solution aligns with security best practices by ensuring graceful degradation rather than complete system failure, maintaining system availability while flagging potentially corrupted filesystem states for manual intervention. This approach follows the principle of least privilege and system resilience, ensuring that filesystem errors do not result in complete system crashes but instead provide diagnostic information for recovery operations.