Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate inline dentry name lengths before conversion Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted image can therefore make the conversion path read past the inline filename storage while building the regular dentry block. Validate each inline dentry name length against the inline filename area before copying it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-24T17:17:15.120Z",
  "pubdate": "2026-09-24T17:17:15.120Z",
  "executiveSummary": "A critical memory safety vulnerability exists in the F2FS (Flash-Friendly File System) implementation within the Linux kernel, specifically during the conversion of inline dentries.\nThe vulnerability is classified as an out-of-bounds (OOB) memory read resulting from inadequate validation of internal metadata lengths.\nAffected systems include any Linux kernel deployments utilizing the F2FS file system that support inline dentry storage.\nThe risk implication is potential information disclosure or system instability, as a maliciously crafted file system image can force the kernel to read arbitrary data beyond the allocated buffer during dentry conversion.\nAn attacker with the capability to supply a filesystem image (e.g., via removable media or mounted disk image) can exploit this flaw to induce an OOB access when the kernel attempts to process the corrupted metadata.\nThe vulnerability requires no network interaction but necessitates the mounting of a compromised or corrupted F2FS image, making it primarily a local attack vector targeting file system parsing logic.",
  "technicalDetails": "The vulnerability originates in the F2FS dentry conversion logic, which is responsible for transitioning inline dentries into standard dentry blocks. In the F2FS architecture, inline dentries store file names directly within the inode or dentry page to optimize small file metadata performance.\nThe root cause is a missing bounds validation step prior to memory copy operations. The kernel iterates through the inline dentry slots to copy filenames into a temporary buffer; however, the existing implementation fails to verify that the 'name_len' field stored in the dentry metadata is consistent with the remaining space available in the inline dentry area.\nBecause the conversion path performs the memory copy before validating the integrity of the name length field against the size of the slot, it is susceptible to an out-of-bounds read. If a corrupted image provides a name length that exceeds the physical boundary of the inline filename storage area, the kernel's copy mechanism will read adjacent memory blocks beyond the designated source buffer.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious F2FS image containing an inline dentry with an artificially inflated 'name_len' value. 2) The attacker mounts the malicious image on a vulnerable Linux system. 3) A file system operation triggers the conversion of the inline dentry to a regular dentry block. 4) The conversion function, lacking the necessary bounds check, uses the attacker-controlled 'name_len' to perform a copy operation. 5) The kernel reads past the end of the inline filename storage area, potentially leaking sensitive kernel heap memory or triggering a system panic due to an access violation.\nThe vulnerable component is the F2FS kernel module. By failing to ensure that 'name_len' is mathematically consistent with the available storage constraints, the kernel trusts untrusted metadata from the disk. This violation of the trust boundary between stored filesystem structures and kernel memory management permits the OOB read condition, which could lead to sensitive information leakage or, in specific memory layouts, denial of service through kernel oops or page faults."
}