Description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()
syzbot reports a kernel bug as below:
F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4
==================================================================
BUG: KASAN: slab-out-of-bounds in f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline]
BUG: KASAN: slab-out-of-bounds in current_nat_addr fs/f2fs/node.h:213 [inline]
BUG: KASAN: slab-out-of-bounds in f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600
Read of size 1 at addr ffff88807a58c76c by task syz-executor280/5076
CPU: 1 PID: 5076 Comm: syz-executor280 Not tainted 6.9.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline]
current_nat_addr fs/f2fs/node.h:213 [inline]
f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600
f2fs_xattr_fiemap fs/f2fs/data.c:1848 [inline]
f2fs_fiemap+0x55d/0x1ee0 fs/f2fs/data.c:1925
ioctl_fiemap fs/ioctl.c:220 [inline]
do_vfs_ioctl+0x1c07/0x2e50 fs/ioctl.c:838
__do_sys_ioctl fs/ioctl.c:902 [inline]
__se_sys_ioctl+0x81/0x170 fs/ioctl.c:890
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The root cause is we missed to do sanity check on i_xattr_nid during
f2fs_iget(), so that in fiemap() path, current_nat_addr() will access
nat_bitmap w/ offset from invalid i_xattr_nid, result in triggering
kasan bug report, fix it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 3.8 | 5.4.278 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.9.7-1 | — |
| Debian 13 | linux | 6.9.7-1 | — |
| Debian 12 | linux | 6.1.94-1 | — |
| Debian 11 | linux | 5.10.221-1 | DSA-5730-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1052.54 | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-44.44 | USN-6999-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1015.16 | USN-6999-1 |
| Ubuntu 24.04 LTS | linux-gcp +1 | 6.8.0-1014.16 | USN-7004-1, USN-6999-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1010.13 | USN-6999-1 |
| Ubuntu 24.04 LTS | linux-ibm +2 | 6.8.0-1012.12 | USN-6999-1 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1013.14 | USN-7005-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1013.14.1 | USN-7005-1 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1011.12 | USN-6999-2 |
| Ubuntu 24.04 LTS | linux-riscv +1 | 6.8.0-44.44.1 | USN-6999-1 |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-121.131 | USN-7007-3, USN-7007-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1069.75 | USN-7007-1 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1015.16~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1072.81 | USN-7009-1 |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1072.81.1 | USN-7009-1 |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1068.76 | USN-7007-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 +1 | 6.8.0-1014.16~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1066.72 | USN-7007-1 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1052.59 | USN-7007-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-45.45~22.04.1 | USN-7029-1 |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1062.65 | USN-7007-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 +1 | 6.8.0-1012.12~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1064.70 | USN-7007-1 |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1066.71 | USN-7007-1 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1064.65 | USN-7007-1 |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1013.14~22.04.1 | USN-7005-2 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1028.28 | — |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1016.16 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1067.73 | USN-7007-1 |
| Ubuntu 22.04 LTS | linux-riscv +31 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv-6.8 +1 | 6.8.0-44.44.1~22.04.1 | USN-7008-1 |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1035.39 | USN-7019-1 |
| Ubuntu 20.04 LTS | linux | 5.4.0-192.212 | USN-6951-1 |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1130.140 | USN-6951-1 |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1069.75~20.04.1 | USN-7007-1 |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1135.142 | USN-6951-2 |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1072.81~20.04.1 | USN-7009-1 |
| Ubuntu 20.04 LTS | linux-azure-fde-5.15 | 5.15.0-1072.81~20.04.1.1 | USN-7009-2 |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1090.97 | USN-6951-4 |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1134.143 | USN-6951-1 |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1068.76~20.04.1 | USN-7007-1 |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-gkeop | 5.4.0-1097.101 | USN-6951-1 |
| Ubuntu 20.04 LTS | linux-gkeop-5.15 | 5.15.0-1052.59~20.04.1 | USN-7007-1 |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-121.131~20.04.1 | USN-7007-3, USN-7007-1 |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1077.82 | USN-6951-1 |
| Ubuntu 20.04 LTS | linux-ibm-5.15 | 5.15.0-1062.65~20.04.1 | USN-7007-2 |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1064.70~20.04.1 | USN-7007-1 |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1042.43 | USN-6951-1 |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1118.125 | USN-6951-1 |
| Ubuntu 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1030.30~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1129.138 | USN-6953-1 |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1067.73~20.04.1 | USN-7007-2 |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1114.126 | USN-6951-1 |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1065.69~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1049.53 | USN-6951-1 |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2010.10 | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1008.8 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1063.65 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1070.78 | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1008.8~22.04.1 | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-78.78+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1069.75+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-azure-fips | 5.15.0-1072.81+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-121.131+fips1 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1068.76+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1130.140+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1135.142+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1104.114 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1134.143+fips1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +5 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux-aws-5.4 | 5.4.0-1130.140~18.04.1 | USN-6951-1 |
| Ubuntu Pro 18.04 LTS | linux-azure-5.4 | 5.4.0-1135.142~18.04.1 | USN-6951-3 |
| Ubuntu Pro 18.04 LTS | linux-gcp-5.4 | 5.4.0-1134.143~18.04.1 | USN-6951-1 |
| Ubuntu Pro 18.04 LTS | linux-hwe-5.4 | 5.4.0-192.212~18.04.1 | USN-6951-1 |
| Ubuntu Pro 18.04 LTS | linux-ibm-5.4 | 5.4.0-1077.82~18.04.1 | USN-6951-1 |
| Ubuntu Pro 18.04 LTS | linux-oracle-5.4 | 5.4.0-1129.138~18.04.1 | USN-6953-1 |
| Ubuntu Pro 18.04 LTS | linux-raspi-5.4 | 5.4.0-1114.126~18.04.1 | USN-6979-1 |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | kernel-uek-container +1 | 5.4.17-2136.334.6.el8 | ELSA-2024-12584 |
| Oracle Linux 7 | kernel-uek +4 | 5.4.17-2136.334.6.el8uek | ELSA-2024-12581 |
| Oracle Linux 7 | kernel-uek-container +1 | 5.4.17-2136.334.6.el7 | ELSA-2024-12585 |
| Oracle Linux 7 | perf +3 | 5.4.17-2136.334.6.el7uek | ELSA-2024-12581 |
Advisories 24
- WID-SEC-2024-1451 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 29, 2026
- USN-7007-1 linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-oracle, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-6999-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oem-6.8, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7009-1 linux-azure, linux-azure-5.15, linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7007-3 linux-lowlatency, linux-lowlatency-hwe-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7029-1 linux-hwe-6.8 Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7005-1 linux-nvidia, linux-nvidia-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7004-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7005-2 linux-nvidia-6.8 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7008-1 linux-lowlatency-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7019-1 linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-6999-2 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-7007-2 linux-ibm-5.15, linux-oracle-5.15 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-6951-1 linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-raspi, linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6979-1 linux-raspi-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6951-3 linux-azure-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6953-1 linux-oracle, linux-oracle-5.4 vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6951-4 linux-bluefield vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-6951-2 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Oct 23, 2026
- USN-7009-2 linux-azure-fde-5.15 vulnerabilities Ubuntu Security Notices (USN) · Aug 6, 2026
- DSA-5730-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ELSA-2024-12585 Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 12, 2024
- ELSA-2024-12584 Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 12, 2024
- ELSA-2024-12581 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 12, 2024
References
- https://git.kernel.org/stable/c/c559a8d840562fbfce9f318448dda2f7d3e6d8e8
- https://git.kernel.org/stable/c/75c87e2ac6149abf44bdde0dd6d541763ddb0dff
- https://git.kernel.org/stable/c/1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98
- https://git.kernel.org/stable/c/8c8aa473fe6eb46a4bf99f3ea2dbe52bf0c1a1f0
- https://git.kernel.org/stable/c/be0155202e431f3007778568a72432c68f8946ba
- https://git.kernel.org/stable/c/68e3cd4ecb8603936cccdc338929130045df2e57
- https://git.kernel.org/stable/c/20faaf30e55522bba2b56d9c46689233205d7717