CVE-2025-38626

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38626
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode w/ "mode=lfs" mount option, generic/299 will cause system panic as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2835! Call Trace: <TASK> f2fs_allocate_data_block+0x6f4/0xc50 f2fs_map_blocks+0x970/0x1550 f2fs_iomap_begin+0xb2/0x1e0 iomap_iter+0x1d6/0x430 __iomap_dio_rw+0x208/0x9a0 f2fs_file_write_iter+0x6b3/0xfa0 aio_write+0x15d/0x2e0 io_submit_one+0x55e/0xab0 __x64_sys_io_submit+0xa5/0x230 do_syscall_64+0x84/0x2f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0010:new_curseg+0x70f/0x720 The root cause of we run out-of-space is: in f2fs_map_blocks(), f2fs may trigger foreground gc only if it allocates any physical block, it will be a little bit later when there is multiple threads writing data w/ aio/dio/bufio method in parallel, since we always use OPU in lfs mode, so f2fs_map_blocks() does block allocations aggressively. In order to fix this issue, let's give a chance to trigger foreground gc in prior to block allocation in f2fs_map_blocks().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1005a3ca28e90c7a64fa43023f866b960a60f791 Patch
https://git.kernel.org/stable/c/264ede8a52f18647ed5bb5f2bd9bf54f556ad8f5 Patch
https://git.kernel.org/stable/c/385e64a0744584397b4b52b27c96703516f39968 Patch
https://git.kernel.org/stable/c/82765ce5c7a56f9309ee45328e763610eaf11253 Patch
https://git.kernel.org/stable/c/f289690f50a01c3e085d87853392d5b7436a4cee Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

26 Nov 2025, 17:09

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1005a3ca28e90c7a64fa43023f866b960a60f791 - () https://git.kernel.org/stable/c/1005a3ca28e90c7a64fa43023f866b960a60f791 - Patch
References () https://git.kernel.org/stable/c/264ede8a52f18647ed5bb5f2bd9bf54f556ad8f5 - () https://git.kernel.org/stable/c/264ede8a52f18647ed5bb5f2bd9bf54f556ad8f5 - Patch
References () https://git.kernel.org/stable/c/385e64a0744584397b4b52b27c96703516f39968 - () https://git.kernel.org/stable/c/385e64a0744584397b4b52b27c96703516f39968 - Patch
References () https://git.kernel.org/stable/c/82765ce5c7a56f9309ee45328e763610eaf11253 - () https://git.kernel.org/stable/c/82765ce5c7a56f9309ee45328e763610eaf11253 - Patch
References () https://git.kernel.org/stable/c/f289690f50a01c3e085d87853392d5b7436a4cee - () https://git.kernel.org/stable/c/f289690f50a01c3e085d87853392d5b7436a4cee - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: corrección para activar el gc de primer plano durante f2fs_map_blocks() en modo lfs con la opción de montaje "mode=lfs", generic/299 provocará pánico en el sistema como se muestra a continuación: ------------[ cortar aquí ]------------ ¡ERROR del kernel en fs/f2fs/segment.c:2835! Rastreo de llamadas: f2fs_allocate_data_block+0x6f4/0xc50 f2fs_map_blocks+0x970/0x1550 f2fs_iomap_begin+0xb2/0x1e0 iomap_iter+0x1d6/0x430 __iomap_dio_rw+0x208/0x9a0 f2fs_file_write_iter+0x6b3/0xfa0 aio_write+0x15d/0x2e0 io_submit_one+0x55e/0xab0 __x64_sys_io_submit+0xa5/0x230 do_syscall_64+0x84/0x2f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0010:new_curseg+0x70f/0x720 La causa principal de la falta de espacio es que, en f2fs_map_blocks(), f2fs puede activar el recolector de basura en primer plano solo si asigna algún bloque físico. Esto ocurrirá un poco más tarde, cuando varios subprocesos escriban datos con el método aio/dio/bufio en paralelo. Dado que siempre usamos OPU en modo lfs, f2fs_map_blocks() realiza asignaciones de bloques de forma agresiva. Para solucionar este problema, permitamos que el recolector de basura en primer plano se active antes de la asignación de bloques en f2fs_map_blocks().
CWE NVD-CWE-noinfo
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

22 Aug 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-22 16:15

Updated : 2025-11-26 17:09

NVD link : CVE-2025-38626

Mitre link : CVE-2025-38626

CVE.ORG link : CVE-2025-38626

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo