CVE-2025-40137

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the f2fs file system related to handling page cache during inode destruction. Specifically, the issue arises in the f2fs truncate() function where page #0 might be created in the cache but not properly dropped in error scenarios, leading to inconsistencies detected by clear inode(). This can result in a kernel bug and potential filesystem corruption. The issue was identified through syzbot testing, which reported errors related to SSA boundaries, invalid CRC values, and corrupted inline inodes. The vulnerability occurs during the f2fs evict inode() process, specifically within the f2fs truncate() function, f2fs convert inline inode(), and f2fs grab cache folio().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.