CVE-2025-38218 in Linux
Summary
by MITRE • 07/04/2025
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on sit_bitmap_size
w/ below testcase, resize will generate a corrupted image which contains inconsistent metadata, so when mounting such image, it will trigger kernel panic:
touch img truncate -s $((512*1024*1024*1024)) img mkfs.f2fs -f img $((256*1024*1024)) resize.f2fs -s -i img -t $((1024*1024*1024)) mount img /mnt/f2fs
------------[ cut here ]------------
kernel BUG at fs/f2fs/segment.h:863! Oops: invalid opcode: 0000 [#1] SMP PTI
CPU: 11 UID: 0 PID: 3922 Comm: mount Not tainted 6.15.0-rc1+ #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_ra_meta_pages+0x47c/0x490
Call Trace: f2fs_build_segment_manager+0x11c3/0x2600 f2fs_fill_super+0xe97/0x2840 mount_bdev+0xf4/0x140 legacy_get_tree+0x2b/0x50 vfs_get_tree+0x29/0xd0 path_mount+0x487/0xaf0 __x64_sys_mount+0x116/0x150 do_syscall_64+0x82/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fdbfde1bcfe
The reaseon is:
sit_i->bitmap_size is 192, so size of sit bitmap is 192*8=1536, at maximum there are 1536 sit blocks, however MAIN_SEGS is 261893, so that sit_blk_cnt is 4762, build_sit_entries() -> current_sit_addr() tries to access out-of-boundary in sit_bitmap at offset from [1536, 4762), once sit_bitmap
and sit_bitmap_mirror is not the same, it will trigger f2fs_bug_on().
Let's add sanity check in f2fs_sanity_check_ckpt() to avoid panic.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability described in CVE-2025-38218 represents a critical flaw in the Linux kernel's F2FS (Flash-Friendly File System) implementation that can lead to kernel panic and system instability. This issue manifests during the mounting process of a corrupted F2FS image that was created through specific resize operations. The vulnerability stems from inadequate bounds checking in the segment information table (SIT) bitmap handling mechanism, which is fundamental to how F2FS manages flash memory segments. The flaw occurs when the system attempts to access memory locations beyond the allocated bitmap boundaries, triggering a kernel BUG condition that results in immediate system termination.
The technical root cause involves a mismatch between calculated bitmap dimensions and actual segment count values within the F2FS metadata structures. Specifically, when the resize operation is performed on an F2FS filesystem, the system calculates a sit_bitmap_size of 192, which translates to a maximum of 1536 sit blocks. However, the actual segment count (MAIN_SEGS) in the filesystem exceeds this boundary, resulting in a sit_blk_cnt value of 4762. This discrepancy causes the build_sit_entries() function to attempt accessing out-of-bounds memory locations within the sit_bitmap array, specifically at offsets ranging from 1536 to 4762. The situation becomes particularly dangerous when the sit_bitmap and sit_bitmap_mirror arrays contain different values, as this inconsistency triggers the f2fs_bug_on() macro which immediately panics the kernel.
The operational impact of this vulnerability is severe as it can cause complete system crashes during normal mount operations, effectively rendering affected filesystems unusable and potentially leading to data loss. This vulnerability affects systems running Linux kernel versions that include the F2FS implementation, particularly those using the specific resize.f2fs command sequence that creates the problematic image state. The attack scenario requires an attacker to have access to create and manipulate F2FS filesystem images, making this a local privilege escalation or denial-of-service vector. The vulnerability is classified under CWE-129 as an "Improper Validation of Array Index" and aligns with ATT&CK technique T1490 for "Inhibit System Recovery" through system instability. The kernel panic occurs at the fs/f2fs/segment.h:863 location in the f2fs_ra_meta_pages function, indicating that the memory access violation happens during metadata page retrieval operations.
The recommended mitigation strategy involves implementing proper sanity checks in the f2fs_sanity_check_ckpt() function to validate the bitmap size against the actual segment count before proceeding with filesystem mounting operations. This fix ensures that inconsistent metadata states are detected and rejected before they can cause kernel panic conditions. System administrators should update to kernel versions that include the patched F2FS implementation and monitor for any filesystem corruption that might have occurred due to this vulnerability. Additionally, organizations should implement proper filesystem validation procedures before mounting F2FS images, particularly those created through automated resize operations. The fix addresses the core issue by preventing the invalid memory access that occurs when the system attempts to map segment information beyond the allocated bitmap boundaries, thereby maintaining system stability and preventing unauthorized denial-of-service conditions.