Linux Kernel F2FS Error Handling Vulnerability in Multiple Distributions

CVE-2025-40137

What is CVE-2025-40137?

A vulnerability exists in the Linux kernel's F2FS (Flash-Friendly File System) related to improper handling of page truncation during error scenarios. This flaw can lead to data corruption and unexpected behavior in the filesystem, particularly evident in the 'f2fs_truncate()' function. When the kernel fails to properly truncate all page cache before destroying an inode after a failure, it can leave inodes in an inconsistent state, potentially causing system hangs or crashes. Users running affected versions are advised to monitor their systems for anomalies and apply updates to mitigate risks.

References