CVE-2025-40138: f2fs: fix to avoid NULL pointer dereference in f2fs_check_quota_consistency()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid NULL pointer dereference in f2fscheckquotaconsistency()
syzbot reported a f2fs bug as below:
Oops: gen[ 107.736417][ T5848] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 5848 Comm: syz-executor263 Tainted: G W 6.17.0-rc1-syzkaller-00014-g0e39a731820a #0 PREEMPT{RT,(full)} RIP: 0010:strcmp+0x3c/0xc0 lib/string.c:284 Call Trace: <TASK> f2fscheckquotaconsistency fs/f2fs/super.c:1188 [inline] f2fscheckoptconsistency+0x1378/0x2c10 fs/f2fs/super.c:1436 f2fsremount fs/f2fs/super.c:2653 [inline] f2fsreconfigure+0x482/0x1770 fs/f2fs/super.c:5297 reconfiguresuper+0x224/0x890 fs/super.c:1077 doremount fs/namespace.c:3314 [inline] pathmount+0xd18/0xfe0 fs/namespace.c:4112 domount fs/namespace.c:4133 [inline] dosysmount fs/namespace.c:4344 [inline] sesysmount+0x317/0x410 fs/namespace.c:4321 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xfa/0x3b0 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
The direct reason is f2fscheckquotaconsistency() may suffer null-ptr-deref issue in strcmp().
The bug can be reproduced w/ below scripts: mkfs.f2fs -f /dev/vdb mount -t f2fs -o usrquota /dev/vdb /mnt/f2fs quotacheck -uc /mnt/f2fs/ umount /mnt/f2fs mount -t f2fs -o usrjquota=aquota.user,jqfmt=vfsold /dev/vdb /mnt/f2fs mount -t f2fs -o remount,usrjquota=,jqfmt=vfsold /dev/vdb /mnt/f2fs umount /mnt/f2fs
So, before oldqname and newqname comparison, we need to check whether they are all valid pointers, fix it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40138?
CVE-2025-40138 is considered to be of moderate severity due to the potential for a NULL pointer dereference that can lead to system instability.
How do I fix CVE-2025-40138?
To fix CVE-2025-40138, update the Linux kernel to the latest stable version where this vulnerability has been resolved.
What impact does CVE-2025-40138 have on Linux systems?
CVE-2025-40138 can potentially cause general protection faults leading to system crashes, impacting system reliability.
Which versions of the Linux kernel are affected by CVE-2025-40138?
CVE-2025-40138 affects versions of the Linux kernel prior to the fix being applied in the updated releases.
Is there a workaround for CVE-2025-40138 before patching?
Currently, the best recommendation is to apply the patch as there are no effective workarounds available for CVE-2025-40138.