Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its fields in f2fs_listxattr(). Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a successful partial result.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:42.693Z",
  "pubdate": "2026-08-28T08:16:42.693Z",
  "executiveSummary": "A critical vulnerability exists in the Linux kernel's F2FS (Flash-Friendly File System) implementation regarding the handling of extended attributes (xattrs).\nThe flaw manifests as an improper validation of xattr entries within the f2fs_listxattr() function, allowing an attacker to trigger an out-of-bounds memory read when processing corrupted filesystem structures.\nThe vulnerability type is an Improper Input Validation leading to potential information disclosure or kernel-level memory corruption.\nSuccessful exploitation allows a local attacker to bypass filesystem integrity checks by supplying a maliciously crafted or corrupted filesystem image.\nIf triggered, this can lead to an information leak of sensitive kernel stack data or cause a system crash (kernel panic) due to invalid memory access.\nThis vulnerability specifically affects the Linux kernel F2FS driver; mitigation requires patching the kernel to enforce strict boundary checks on xattr entry structures.",
  "technicalDetails": "The vulnerability is located within the f2fs_listxattr() function in the Linux kernel F2FS driver. The function is responsible for iterating through extended attributes associated with a file or directory. The root cause is the lack of proper boundary validation when the kernel traverses the xattr storage area.\nIn the vulnerable implementation, the kernel attempts to read fields from an xattr entry structure before ensuring that the entry resides entirely within the valid, allocated xattr storage area defined by the filesystem metadata. When a corrupted filesystem image is mounted, the internal xattr indices may point to memory offsets that lie outside the legitimate bounds of the xattr header or the underlying buffer.\nThe attack flow initiates when a user or process mounts a malicious or corrupted F2FS image containing a crafted xattr structure. When the listxattr system call is invoked on a file within this image, the kernel executes the f2fs_listxattr() logic. Because the current implementation trusts the offset calculation for the next xattr entry without verifying it against the total buffer size, it proceeds to read data at an arbitrary offset.\nBy manipulating the xattr entry offsets, an attacker can force the kernel to return partial or garbage data from adjacent kernel memory to the user space via the listxattr interface. This results in an information disclosure vulnerability, potentially exposing sensitive kernel memory structures. Alternatively, if the entry points to unmapped memory or invalid memory regions, the kernel will trigger a page fault, leading to a denial-of-service condition through a kernel panic.\nThis vulnerability is particularly dangerous because it bypasses the expected functional constraints of the F2FS xattr subsystem. The fix mandates that the filesystem driver must explicitly validate the bounds of the entry structure against the valid storage area. If the entry pointer is calculated to be outside these bounds, the function must terminate immediately and return -EFSCORRUPTED, preventing any further processing of the malformed metadata. This defense-in-depth approach prevents the kernel from executing operations on unvalidated pointer arithmetic, thereby mitigating both potential information leaks and instability caused by memory access violations.\nThe scope of impact is limited to local users with the privilege to mount filesystems or access malicious images, as the vulnerability requires the presence of a corrupted on-disk structure to trigger the flawed code path."
}