# CVE-2025-40025: f2fs: fix to do sanity check on node footer for non inode dnode

CVE-2025-40025 is fixed in linux on 1 platform by DEBIAN-CVE-2025-40025 (version 6.17.6-1), released October 28, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-40025
- Priority: High
- CVSS: 7.8 (Moderate)
- EPSS: 0.0014
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 28, 2025
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-40025

## Description

In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to do sanity check on node footer for non inode dnode  As syzbot reported below:  ------------[ cut here ]------------ kernel BUG at fs/f2fs/file.c:1243! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted 6.17.0-rc1-syzkaller-00211-g90d970cade8e #0 PREEMPT(full) RIP: 0010:f2fs_truncate_hole+0x69e/0x6c0 fs/f2fs/file.c:1243 Call Trace:  <TASK>  f2fs_punch_hole+0x2db/0x330 fs/f2fs/file.c:1306  f2fs_fallocate+0x546/0x990 fs/f2fs/file.c:2018  vfs_fallocate+0x666/0x7e0 fs/open.c:342  ksys_fallocate fs/open.c:366 [inline]  __do_sys_fallocate fs/open.c:371 [inline]  __se_sys_fallocate fs/open.c:369 [inline]  __x64_sys_fallocate+0xc0/0x110 fs/open.c:369  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]  do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1e65f8ebe9  w/ a fuzzed image, f2fs may encounter panic due to it detects inconsistent truncation range in direct node in f2fs_truncate_hole().  The root cause is: a non-inode dnode may has the same footer.ino and footer.nid, so the dnode will be parsed as an inode, then ADDRS_PER_PAGE() may return wrong blkaddr count which may be 923 typically, by chance, dn.ofs_in_node is equal to 923, then count can be calculated to 0 in below statement, later it will trigger panic w/ f2fs_bug_on(, count == 0 || ...).  	count = min(end_offset - dn.ofs_in_node, pg_end - pg_start);  This patch introduces a new node_type NODE_TYPE_NON_INODE, then allowing passing the new_type to sanity_check_node_footer in f2fs_get_node_folio() to detect corruption that a non-inode dnode has the same footer.ino and footer.nid.  Scripts to reproduce: mkfs.f2fs -f /dev/vdb mount /dev/vdb /mnt/f2fs touch /mnt/f2fs/foo touch /mnt/f2fs/bar dd if=/dev/zero of=/mnt/f2fs/foo bs=1M count=8 umount /mnt/f2fs inject.f2fs --node --mb i_nid --nid 4 --idx 0 --val 5 /dev/vdb mount /dev/vdb /mnt/f2fs xfs_io /mnt/f2fs/foo -c "fpunch 6984k 4k"

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.17.6-1 | [DEBIAN-CVE-2025-40025](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40025.md) | Oct 28, 2025 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.