LiveActive security incident?Get immediate response
CVE Record

CVE-2025-22127: f2fs: fix potential deadloop in prepare_compress_overwrite()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadloop in prepare_compress_overwrite() Jan Prusakowski reported a kernel hang issue as below: When running xfstests on linux-next kernel (6.14.0-rc3, 6.12) I encountered a problem in generic/475 test where fsstress process gets blocked in __f2fs_write_data_pages() and the test hangs. The options I used are: MKFS_OPTIONS -- -O compression -O extra_attr -O project_quota -O quota /dev/vdc MOUNT_OPTIONS -- -o acl,user_xattr -o discard,compress_extension=* /dev/vdc /vdc INFO: task kworker/u8:0:11 blocked for more than 122 seconds. Not tainted 6.14.0-rc3-xfstests-lockdep #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:0 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208160 flags:0x00004000 Workqueue: writeback wb_workfn (flush-253:0) Call Trace: <TASK> __schedule+0x309/0x8e0 schedule+0x3a/0x100 schedule_preempt_disabled+0x15/0x30 __mutex_lock+0x59a/0xdb0 __f2fs_write_data_pages+0x3ac/0x400 do_writepages+0xe8/0x290 __writeback_single_inode+0x5c/0x360 writeback_sb_inodes+0x22f/0x570 wb_writeback+0xb0/0x410 wb_do_writeback+0x47/0x2f0 wb_workfn+0x5a/0x1c0 process_one_work+0x223/0x5b0 worker_thread+0x1d5/0x3c0 kthread+0xfd/0x230 ret_from_fork+0x31/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> The root cause is: once generic/475 starts toload error table to dm device, f2fs_prepare_compress_overwrite() will loop reading compressed cluster pages due to IO error, meanwhile it has held .writepages lock, it can block all other writeback tasks. Let's fix this issue w/ below changes: - add f2fs_handle_page_eio() in prepare_compress_overwrite() to detect IO error. - detect cp_error earler in f2fs_read_multi_pages().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel f2fs issue can cause a system hang when compressed f2fs writeback encounters I/O errors. The main business risk is availability, not data theft, based on the provided sources. Systems using f2fs compression need kernel vendor review and patch planning.

Executive priority

Treat as a targeted availability risk. It is most urgent for services relying on f2fs compression or exposed to storage faults. Without evidence of active exploitation or CVSS scoring, prioritize through normal kernel maintenance unless affected systems show hangs.

Technical view

The flaw is a potential deadloop in f2fs prepare_compress_overwrite(). During compressed cluster reads after I/O errors, the code can loop while holding the writepages lock, blocking other writeback tasks. Kernel stable fixes add I/O error handling and earlier cp_error detection.

Likely exposure

Exposure appears limited to Linux systems using f2fs, especially mounts with compression enabled. The provided affected-version data is incomplete for distribution kernels, so teams should map their vendor kernel packages to the referenced upstream stable fixes.

Exploitation context

No active exploitation is stated in the provided sources, and KEV is false. The report describes a reproducible test hang involving xfstests, f2fs compression, and injected device I/O errors, which points to denial-of-service conditions rather than remote compromise.

Researcher notes

Evidence comes from the Linux CVE record and stable kernel commits. The root cause and fix direction are clear, but exploitability, exact distribution impact, and fixed package versions are not provided in the bundle.

Mitigation direction

  • Check Linux distribution guidance for fixed kernel packages.
  • Update affected kernels to versions containing the referenced stable fixes.
  • Prioritize hosts using f2fs with compression enabled.
  • Plan reboots where kernel package updates require them.
  • Monitor affected systems for hung task and writeback blockage symptoms.

Validation and detection

  • Inventory Linux systems using f2fs filesystems.
  • Identify f2fs mounts with compression enabled.
  • Confirm whether deployed kernels include the referenced fix commits.
  • Review kernel logs for hung writeback or blocked task messages.
  • Map vendor kernel versions to upstream fixed commits.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-22127 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4c8ff7095bef64fc47e996a938f7d57f9e077da3, 4c8ff7095bef64fc47e996a938f7d57f9e077da3unaffected
LinuxLinux5.6, 0, 6.14.2, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.