# CVE-2025-68772: f2fs: fix to avoid updating compression context during writeback

CVE-2025-68772 is fixed in linux on 1 platform, first by DEBIAN-CVE-2025-68772, released January 13, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-68772
- Priority: Routine
- CVSS: 5.0 (Moderate)
- EPSS: 0.0020
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jan 13, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-68772

## Description

In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to avoid updating compression context during writeback  Bai, Shuangpeng <sjb7183@psu.edu> reported a bug as below:  Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 11441 Comm: syz.0.46 Not tainted 6.17.0 #1 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:f2fs_all_cluster_page_ready+0x106/0x550 fs/f2fs/compress.c:857 Call Trace:  <TASK>  f2fs_write_cache_pages fs/f2fs/data.c:3078 [inline]  __f2fs_write_data_pages fs/f2fs/data.c:3290 [inline]  f2fs_write_data_pages+0x1c19/0x3600 fs/f2fs/data.c:3317  do_writepages+0x38e/0x640 mm/page-writeback.c:2634  filemap_fdatawrite_wbc mm/filemap.c:386 [inline]  __filemap_fdatawrite_range mm/filemap.c:419 [inline]  file_write_and_wait_range+0x2ba/0x3e0 mm/filemap.c:794  f2fs_do_sync_file+0x6e6/0x1b00 fs/f2fs/file.c:294  generic_write_sync include/linux/fs.h:3043 [inline]  f2fs_file_write_iter+0x76e/0x2700 fs/f2fs/file.c:5259  new_sync_write fs/read_write.c:593 [inline]  vfs_write+0x7e9/0xe00 fs/read_write.c:686  ksys_write+0x19d/0x2d0 fs/read_write.c:738  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]  do_syscall_64+0xf7/0x470 arch/x86/entry/syscall_64.c:94  entry_SYSCALL_64_after_hwframe+0x77/0x7f  The bug was triggered w/ below race condition:  fsync				setattr			ioctl - f2fs_do_sync_file  - file_write_and_wait_range   - f2fs_write_cache_pages   : inode is non-compressed   : cc.cluster_size =     F2FS_I(inode)->i_cluster_size = 0    - tag_pages_for_writeback 				- f2fs_setattr 				 - truncate_setsize 				 - f2fs_truncate 							- f2fs_fileattr_set 							 - f2fs_setflags_common 							  - set_compress_context 							  : F2FS_I(inode)->i_cluster_size = 4 							  : set_inode_flag(inode, FI_COMPRESSED_FILE)    - f2fs_compressed_file    : return true    - f2fs_all_cluster_page_ready    : "pgidx % cc->cluster_size" trigger dividing 0 issue  Let's change as below to fix this issue: - introduce a new atomic type variable .writeback in structure f2fs_inode_info to track the number of threads which calling f2fs_write_cache_pages(). - use .i_sem lock to protect .writeback update. - check .writeback before update compression context in f2fs_setflags_common() to avoid race w/ ->writepages.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.162-1 | [DEBIAN-CVE-2025-68772](https://patchblox.com/security/data/fix/linux/debian-cve-2025-68772.md) | Jan 13, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.69-1 | [DEBIAN-CVE-2025-68772](https://patchblox.com/security/data/fix/linux/debian-cve-2025-68772.md) | Jan 13, 2026 |
| Linux | linux Debian 14 | 6.18.3-1 | [DEBIAN-CVE-2025-68772](https://patchblox.com/security/data/fix/linux/debian-cve-2025-68772.md) | Jan 13, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.