linux-cve-announce - CVE-2025-71107: f2fs: ensure node page reads complete before f2fs_put

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026011411-CVE-2025-71107-01b5@gregkh>
Date: Wed, 14 Jan 2026 16:06:12 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-71107: f2fs: ensure node page reads complete before f2fs_put_super() finishes

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

f2fs: ensure node page reads complete before f2fs_put_super() finishes

Xfstests generic/335, generic/336 sometimes crash with the following message:

F2FS-fs (dm-0): detect filesystem reference count leak during umount, type: 9, count: 1
------------[ cut here ]------------
kernel BUG at fs/f2fs/super.c:1939!
Oops: invalid opcode: 0000 [#1] SMP NOPTI
CPU: 1 UID: 0 PID: 609351 Comm: umount Tainted: G        W           6.17.0-rc5-xfstests-g9dd1835ecda5 #1 PREEMPT(none)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:f2fs_put_super+0x3b3/0x3c0
Call Trace:
 <TASK>
 generic_shutdown_super+0x7e/0x190
 kill_block_super+0x1a/0x40
 kill_f2fs_super+0x9d/0x190
 deactivate_locked_super+0x30/0xb0
 cleanup_mnt+0xba/0x150
 task_work_run+0x5c/0xa0
 exit_to_user_mode_loop+0xb7/0xc0
 do_syscall_64+0x1ae/0x1c0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
 </TASK>
---[ end trace 0000000000000000 ]---

It appears that sometimes it is possible that f2fs_put_super() is called before
all node page reads are completed.
Adding a call to f2fs_wait_on_all_pages() for F2FS_RD_NODE fixes the problem.

The Linux kernel CVE team has assigned CVE-2025-71107 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.5 with commit 20872584b8c0b006c007da9588a272c9e28d2e18 and fixed in 6.6.120 with commit c3031cf2b61f1508662fc95ef9ad505cb0882a5f
	Issue introduced in 6.5 with commit 20872584b8c0b006c007da9588a272c9e28d2e18 and fixed in 6.12.64 with commit 3b15d5f12935e9e25f9a571e680716bc9ee61025
	Issue introduced in 6.5 with commit 20872584b8c0b006c007da9588a272c9e28d2e18 and fixed in 6.18.3 with commit 0b36fae23621a09e772c8adf918b9011158f8511
	Issue introduced in 6.5 with commit 20872584b8c0b006c007da9588a272c9e28d2e18 and fixed in 6.19-rc1 with commit 297baa4aa263ff8f5b3d246ee16a660d76aa82c4
	Issue introduced in 6.4.16 with commit 0e2577074b459bba7f4016f4d725ede37d48bb22

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-71107
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/f2fs/super.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c3031cf2b61f1508662fc95ef9ad505cb0882a5f
	https://git.kernel.org/stable/c/3b15d5f12935e9e25f9a571e680716bc9ee61025
	https://git.kernel.org/stable/c/0b36fae23621a09e772c8adf918b9011158f8511
	https://git.kernel.org/stable/c/297baa4aa263ff8f5b3d246ee16a660d76aa82c4