{"id":"CVE-2025-68315","state":"PUBLISHED","title":"f2fs: fix to detect potential corrupted nid in free_nid_list","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to detect potential corrupted nid in free_nid_list\n\nAs reported, on-disk footer.ino and footer.nid is the same and\nout-of-range, let's add sanity check on f2fs_alloc_nid() to detect\nany potential corruption in free_nid_list.","publishedAt":"2025-12-16T15:39:45.716Z","updatedAt":"2026-08-05T12:10:49.846Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"88b2ddb0c4f1dc874d4598e78cc830c64315ed86","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"9337ed5e777e1c19854928cba7a8131dd00e611b","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"6b9525596a83cd5b7bbc2c7bd5f9ad9cf5ad60fa","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"adbcb34f03abb89e681a5907c4c3ce4bf224991d","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"8fc6056dcf79937c46c97fa4996cda65956437a9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/node.c","include/linux/f2fs_fs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.8","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.58","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.8","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/node.c","include/linux/f2fs_fs.h"]}],"references":["https://git.kernel.org/stable/c/88b2ddb0c4f1dc874d4598e78cc830c64315ed86","https://git.kernel.org/stable/c/9337ed5e777e1c19854928cba7a8131dd00e611b","https://git.kernel.org/stable/c/6b9525596a83cd5b7bbc2c7bd5f9ad9cf5ad60fa","https://git.kernel.org/stable/c/adbcb34f03abb89e681a5907c4c3ce4bf224991d","https://git.kernel.org/stable/c/8fc6056dcf79937c46c97fa4996cda65956437a9"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:56.034Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/68xxx/CVE-2025-68315.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68315","state":"PUBLISHED","datePublished":"2025-12-16T15:39:45.716Z","dateUpdated":"2026-08-05T12:10:49.846Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-12-16T14:48:05.295Z"},"containers":{"cna":{"title":"f2fs: fix to detect potential corrupted nid in free_nid_list","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to detect potential corrupted nid in free_nid_list\n\nAs reported, on-disk footer.ino and footer.nid is the same and\nout-of-range, let's add sanity check on f2fs_alloc_nid() to detect\nany potential corruption in free_nid_list."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"88b2ddb0c4f1dc874d4598e78cc830c64315ed86","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"9337ed5e777e1c19854928cba7a8131dd00e611b","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"6b9525596a83cd5b7bbc2c7bd5f9ad9cf5ad60fa","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"adbcb34f03abb89e681a5907c4c3ce4bf224991d","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","status":"affected","lessThan":"8fc6056dcf79937c46c97fa4996cda65956437a9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/node.c","include/linux/f2fs_fs.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.8","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.58","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.8","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/node.c","include/linux/f2fs_fs.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/88b2ddb0c4f1dc874d4598e78cc830c64315ed86"},{"url":"https://git.kernel.org/stable/c/9337ed5e777e1c19854928cba7a8131dd00e611b"},{"url":"https://git.kernel.org/stable/c/6b9525596a83cd5b7bbc2c7bd5f9ad9cf5ad60fa"},{"url":"https://git.kernel.org/stable/c/adbcb34f03abb89e681a5907c4c3ce4bf224991d"},{"url":"https://git.kernel.org/stable/c/8fc6056dcf79937c46c97fa4996cda65956437a9"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - F2FS supports NFS exports, and a network NFS CREATE request reaches nfsd3_proc_create(), vfs_create(), f2fs_create(), f2fs_new_inode(), and f2fs_alloc_nid(). A writable F2FS-backed NFS server is a reasonable network-facing deployment.\nAC:L - Once an invalid NID is present, allocation deterministically consumes it from the list head; repeated CREATE requests require no race or timing conditions. Older affected kernels also lacked producer-side range validation, allowing corrupted metadata to seed the list directly.\nPR:N - A writable NFS export accepting AUTH_NULL or unauthenticated AUTH_SYS requests permits CREATE without verified credentials. The allocation path itself performs no capability check.\nUI:N - The attacker can trigger allocation directly with network filesystem operations; no victim action is required during exploitation.\nS:U - The vulnerable filesystem code and the affected kernel memory, execution, and storage resources share the same kernel security authority.\nC:H - The invalid NID causes out-of-bounds bitmap and pointer-array reads, and the resulting kernel memory corruption can plausibly be leveraged to disclose arbitrary kernel memory.\nI:H - The unchecked index can drive an out-of-bounds bit clear and counter decrement through free_nid_bitmap and free_nid_count, while also committing invalid node and NAT metadata. These writes can plausibly enable control-flow compromise and persistent filesystem corruption.\nA:H - The out-of-bounds accesses can crash or hang the kernel, while invalid node metadata can force checkpoint failure or persistent filesystem unavailability. Network requests can trigger the condition repeatedly."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:10:49.846Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.12.58"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.17.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.18"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}