# CVE-2025-40054: linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix UAF issue in f2fs_merge_page_bio()  As...

CVE-2025-40054 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2025-40054, released October 28, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-40054
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 28, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix UAF issue in f2fs_merge_page_bio()  As JY reported in bugzilla [1],  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98 lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4 CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P    B   W  OE      6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5 Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Workqueue: writeback wb_workfn (flush-254:49) Call trace:  f2fs_is_cp_guaranteed+0x70/0x98  f2fs_inplace_write_data+0x174/0x2f4  f2fs_do_write_data_page+0x214/0x81c  f2fs_write_single_data_page+0x28c/0x764  f2fs_write_data_pages+0x78c/0xce4  do_writepages+0xe8/0x2fc  __writeback_single_inode+0x4c/0x4b4  writeback_sb_inodes+0x314/0x540  __writeback_inodes_wb+0xa4/0xf4  wb_writeback+0x160/0x448  wb_workfn+0x2f0/0x5dc  process_scheduled_works+0x1c8/0x458  worker_thread+0x334/0x3f0  kthread+0x118/0x1ac  ret_from_fork+0x10/0x20  [1] https://bugzilla.kernel.org/show_bug.cgi?id=220575  The panic was caused by UAF issue w/ below race condition:  kworker - writepages  - f2fs_write_cache_pages   - f2fs_write_single_data_page    - f2fs_do_write_data_page     - f2fs_inplace_write_data      - f2fs_merge_page_bio       - add_inu_page       : cache page #1 into bio & cache bio in         io->bio_list   - f2fs_write_single_data_page    - f2fs_do_write_data_page     - f2fs_inplace_write_data      - f2fs_merge_page_bio       - add_inu_page       : cache page #2 into bio which is linked         in io->bio_list 						write 						- f2fs_write_begin 						: write page #1 						 - f2fs_folio_wait_writeback 						  - f2fs_submit_merged_ipu_write 						   - f2fs_submit_write_bio 						   : submit bio which inclues page #1 and #2  						software IRQ 						- f2fs_write_end_io 						 - fscrypt_free_bounce_page 						 : freed bounced page which belongs to page #2       - inc_page_count( , WB_DATA_TYPE(data_folio), false)       : data_folio points to fio->encrypted_page         the bounced page can be freed before         accessing it in f2fs_is_cp_guarantee()  It can reproduce w/ below testcase: Run below script in shell #1: for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ -c "pwrite 0 32k" -c "fdatasync"  Run below script in shell #2: for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ -c "pwrite 0 32k" -c "fdatasync"  So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after commit page into internal ipu cache.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.187-1 | [DEBIAN-CVE-2025-40054](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40054.md) | Oct 28, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.12.105-1 | [DEBIAN-CVE-2025-40054](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40054.md) | Oct 28, 2025 |
| Linux | linux Debian 14 | 6.17.6-1 | [DEBIAN-CVE-2025-40054](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40054.md) | Oct 28, 2025 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.107-1~deb12u1 | [DEBIAN-CVE-2025-40054](https://patchblox.com/security/data/fix/linux/debian-cve-2025-40054.md) | Oct 28, 2025 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.