Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s F2FS filesystem can let segment-allocation processing continue after detecting contradictory filesystem metadata. This may cause kernel warnings and potentially serious confidentiality, integrity, or availability impact. Exposure requires local, low-privileged access and an affected kernel using F2FS; network-only systems without F2FS use are less likely to be exposed.
Executive priority
Treat this as a high-priority kernel maintenance issue for F2FS-dependent systems with local multi-user or untrusted workload exposure. It is less urgent for systems that do not use F2FS. Remediate through supported kernel updates, but do not characterize it as an emergency internet-wide threat because active exploitation is not evidenced.
Technical view
get_new_segment() could detect disagreement between F2FS free_segmap and free_secmap state yet continue into new_curseg(). The resolved behavior records the inconsistency in the superblock and aborts segment allocation. The supplied CVSS 3.1 score is 7.8, with local access, low complexity, low privileges, no user interaction, and high impact ratings.
Likely exposure
Prioritize Linux systems that mount and actively write to F2FS, especially where untrusted or low-privileged local users can execute workloads. The source bundle’s version data is not sufficiently clear for reliable package-level identification, so confirm exposure using distribution advisories and fix inclusion rather than version strings alone.
Exploitation context
The supplied record does not establish active exploitation, and it is not identified as a KEV entry. It also provides no public proof-of-concept evidence. The CVSS vector describes a local, low-privileged attack path, but the available sources do not explain how reliably the inconsistent state can be induced or what practical impacts have been demonstrated.
Researcher notes
The record documents a consistency-check failure path and its defensive correction, but supplies no CWE, exploit analysis, reproduction conditions, or demonstrated security outcome. The affected-version representation is ambiguous and includes duplicated commit identifiers. Researchers should distinguish the warning-triggering bug from proven exploitation and map fixes through vendor backports before declaring a host vulnerable.
Mitigation direction
- Update to a vendor-supported kernel package containing the applicable referenced stable fix.
- Check distribution or kernel vendor guidance for exact fixed releases and any interim mitigations.
- Prioritize remediation on systems actively mounting and writing F2FS volumes.
- Restrict unnecessary local access until affected F2FS systems are updated.
Validation and detection
- Inventory kernel versions and identify systems where F2FS is enabled, mounted, or actively used.
- Compare vendor package changelogs or source trees with the three referenced stable commits.
- Review kernel logs for new_curseg warnings and the supplied F2FS checkpoint call trace.
- After updating, monitor normal F2FS write and checkpoint activity for recurring warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38333 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f0023d7a2a86999c8e1300e911d92f995a5310a8CVE reference, Linux
- https://git.kernel.org/stable/c/ca860f507a61c7c3d4dde47b830a5c0d555cf83cCVE reference, Linux
- https://git.kernel.org/stable/c/bb5eb8a5b222fa5092f60d5555867a05ebc3bdf2CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.