LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68796: f2fs: fix to avoid updating zero-sized extent in extent cache

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating zero-sized extent in extent cache As syzbot reported: F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0] ------------[ cut here ]------------ kernel BUG at fs/f2fs/extent_cache.c:678! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__update_extent_tree_range+0x13bc/0x1500 fs/f2fs/extent_cache.c:678 Call Trace: <TASK> f2fs_update_read_extent_cache_range+0x192/0x3e0 fs/f2fs/extent_cache.c:1085 f2fs_do_zero_range fs/f2fs/file.c:1657 [inline] f2fs_zero_range+0x10c1/0x1580 fs/f2fs/file.c:1737 f2fs_fallocate+0x583/0x990 fs/f2fs/file.c:2030 vfs_fallocate+0x669/0x7e0 fs/open.c:342 ioctl_preallocate fs/ioctl.c:289 [inline] file_ioctl+0x611/0x780 fs/ioctl.c:-1 do_vfs_ioctl+0xb33/0x1430 fs/ioctl.c:576 __do_sys_ioctl fs/ioctl.c:595 [inline] __se_sys_ioctl+0x82/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f07bc58eec9 In error path of f2fs_zero_range(), it may add a zero-sized extent into extent cache, it should be avoided.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-68796 is a Linux kernel F2FS filesystem bug that can trigger a kernel BUG when a zero-sized extent is added to the extent cache. The public report shows a crash path found by syzbot. Business impact is most likely system instability or denial of service on systems using F2FS.

Executive priority

Treat as a targeted stability issue, not an internet-scale emergency. Prioritize patching Linux systems that use F2FS, especially shared, container, test, or device environments where local users can exercise filesystem operations.

Technical view

The flaw is in fs/f2fs extent cache handling during f2fs_zero_range() error handling. A zero-sized extent may be inserted, reaching __update_extent_tree_range() and triggering a kernel BUG. The trace involves fallocate/ioctl paths on an F2FS filesystem. Linux stable references contain fixes to avoid updating zero-sized extents.

Likely exposure

Exposure appears limited to Linux systems with F2FS available and in use. The source data does not clearly identify all vulnerable kernel release ranges, and distribution backport status must be checked separately.

Exploitation context

The evidence is a syzbot crash report, not public real-world exploitation. CISA KEV status is false in the provided bundle. The path suggests local interaction with an F2FS filesystem may be required.

Researcher notes

Severity, CVSS, and CWE are not provided. The affected-version data in the source bundle is inconsistent, so rely on upstream stable commits and distro advisories. Avoid assuming privilege escalation; the public trace supports a kernel crash condition.

Mitigation direction

  • Update to a kernel or vendor package containing the referenced F2FS stable fixes.
  • Check Linux distribution advisories for backported fixes and affected kernel builds.
  • If patching is delayed, assess whether F2FS is required on exposed systems.

Validation and detection

  • Inventory systems using Linux kernels with F2FS enabled or mounted.
  • Confirm installed kernels include the relevant stable commit or vendor backport.
  • Review kernel logs for F2FS BUG messages mentioning __update_extent_tree_range or zero extent length.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68796 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6e9619499f53b22ead972e476c0e8341c997d929, 6e9619499f53b22ead972e476c0e8341c997d929, 6e9619499f53b22ead972e476c0e8341c997d929, 6e9619499f53b22ead972e476c0e8341c997d929, 6e9619499f53b22ead972e476c0e8341c997d929, 6e9619499f53b22ead972e476c0e8341c997d929, 6e9619499f53b22ead972e476c0e8341c997d929unaffected
LinuxLinux4.7, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.