LiveActive security incident?Get immediate response
CVE Record

CVE-2025-22123: f2fs: fix to avoid accessing uninitialized curseg

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid accessing uninitialized curseg syzbot reports a f2fs bug as below: F2FS-fs (loop3): Stopped filesystem due to reason: 7 kworker/u8:7: attempt to access beyond end of device BUG: unable to handle page fault for address: ffffed1604ea3dfa RIP: 0010:get_ckpt_valid_blocks fs/f2fs/segment.h:361 [inline] RIP: 0010:has_curseg_enough_space fs/f2fs/segment.h:570 [inline] RIP: 0010:__get_secs_required fs/f2fs/segment.h:620 [inline] RIP: 0010:has_not_enough_free_secs fs/f2fs/segment.h:633 [inline] RIP: 0010:has_enough_free_secs+0x575/0x1660 fs/f2fs/segment.h:649 <TASK> f2fs_is_checkpoint_ready fs/f2fs/segment.h:671 [inline] f2fs_write_inode+0x425/0x540 fs/f2fs/inode.c:791 write_inode fs/fs-writeback.c:1525 [inline] __writeback_single_inode+0x708/0x10d0 fs/fs-writeback.c:1745 writeback_sb_inodes+0x820/0x1360 fs/fs-writeback.c:1976 wb_writeback+0x413/0xb80 fs/fs-writeback.c:2156 wb_do_writeback fs/fs-writeback.c:2303 [inline] wb_workfn+0x410/0x1080 fs/fs-writeback.c:2343 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Commit 8b10d3653735 ("f2fs: introduce FAULT_NO_SEGMENT") allows to trigger no free segment fault in allocator, then it will update curseg->segno to NULL_SEGNO, though, CP_ERROR_FLAG has been set, f2fs_write_inode() missed to check the flag, and access invalid curseg->segno directly in below call path, then resulting in panic: - f2fs_write_inode - f2fs_is_checkpoint_ready - has_enough_free_secs - has_not_enough_free_secs - __get_secs_required - has_curseg_enough_space - get_ckpt_valid_blocks : access invalid curseg->segno To avoid this issue, let's: - check CP_ERROR_FLAG flag in prior to f2fs_is_checkpoint_ready() in f2fs_write_inode(). - in has_curseg_enough_space(), save curseg->segno into a temp variable, and verify its validation before use.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel F2FS filesystem bug that can make the kernel panic after an internal error leaves segment state invalid. The source describes a crash during inode writeback, not data theft or remote code execution. Business urgency depends on whether affected systems use F2FS and can encounter the triggering storage condition.

Executive priority

Prioritize patching where F2FS supports production workloads or availability-sensitive devices. For general servers not using F2FS, urgency is lower but kernel updates should still follow normal maintenance. No active exploitation is supported by the supplied sources.

Technical view

F2FS can access an invalid curseg->segno after FAULT_NO_SEGMENT sets it to NULL_SEGNO and CP_ERROR_FLAG is already set. f2fs_write_inode missed the checkpoint error check before f2fs_is_checkpoint_ready, leading to invalid access in get_ckpt_valid_blocks through has_curseg_enough_space. The fix checks CP_ERROR_FLAG earlier and validates a saved segno before use.

Likely exposure

Exposure appears limited to Linux systems running affected kernels with F2FS in use. The source lists Linux kernel versions and stable commits, but package-level distribution impact is not provided. Systems not using F2FS are unlikely to be affected by this specific crash path.

Exploitation context

The source cites a syzbot report using a loop device and does not claim public exploitation. CISA KEV status is false in the provided bundle. Treat this as a stability and denial-of-service risk unless vendor advisories add stronger exploitation evidence.

Researcher notes

The affected-version data in the bundle is incomplete and oddly formatted, so validate against upstream stable branches and vendor packages. The bug is an unchecked error-state path after no-free-segment fault injection, ending in invalid segment-number use during writeback.

Mitigation direction

  • Apply vendor kernel updates that include the linked stable F2FS fixes.
  • Check Linux distribution advisories for exact fixed package versions.
  • Limit mounting of untrusted F2FS images until patched.
  • Prioritize systems where F2FS is used for critical storage.

Validation and detection

  • Inventory Linux kernel versions across affected fleets.
  • Identify systems with mounted or configured F2FS filesystems.
  • Confirm the kernel includes one of the referenced stable fix commits.
  • Review kernel logs for F2FS checkpoint errors or related panics.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-22123 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8b10d3653735e117bc1954ade80d75ad7b46b801, 8b10d3653735e117bc1954ade80d75ad7b46b801, 8b10d3653735e117bc1954ade80d75ad7b46b801unaffected
LinuxLinux6.9, 0, 6.12.33, 6.14.2, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.