{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68315","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-12-16T14:48:05.295Z","datePublished":"2025-12-16T15:39:45.716Z","dateUpdated":"2026-08-05T12:10:49.846Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:10:49.846Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to detect potential corrupted nid in free_nid_list\n\nAs reported, on-disk footer.ino and footer.nid is the same and\nout-of-range, let's add sanity check on f2fs_alloc_nid() to detect\nany potential corruption in free_nid_list."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - F2FS supports NFS exports, and a network NFS CREATE request reaches nfsd3_proc_create(), vfs_create(), f2fs_create(), f2fs_new_inode(), and f2fs_alloc_nid(). A writable F2FS-backed NFS server is a reasonable network-facing deployment.\nAC:L - Once an invalid NID is present, allocation deterministically consumes it from the list head; repeated CREATE requests require no race or timing conditions. Older affected kernels also lacked producer-side range validation, allowing corrupted metadata to seed the list directly.\nPR:N - A writable NFS export accepting AUTH_NULL or unauthenticated AUTH_SYS requests permits CREATE without verified credentials. The allocation path itself performs no capability check.\nUI:N - The attacker can trigger allocation directly with network filesystem operations; no victim action is required during exploitation.\nS:U - The vulnerable filesystem code and the affected kernel memory, execution, and storage resources share the same kernel security authority.\nC:H - The invalid NID causes out-of-bounds bitmap and pointer-array reads, and the resulting kernel memory corruption can plausibly be leveraged to disclose arbitrary kernel memory.\nI:H - The unchecked index can drive an out-of-bounds bit clear and counter decrement through free_nid_bitmap and free_nid_count, while also committing invalid node and NAT metadata. These writes can plausibly enable control-flow compromise and persistent filesystem corruption.\nA:H - The out-of-bounds accesses can crash or hang the kernel, while invalid node metadata can force checkpoint failure or persistent filesystem unavailability. Network requests can trigger the condition repeatedly."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/node.c","include/linux/f2fs_fs.h"],"versions":[{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"88b2ddb0c4f1dc874d4598e78cc830c64315ed86","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"9337ed5e777e1c19854928cba7a8131dd00e611b","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"6b9525596a83cd5b7bbc2c7bd5f9ad9cf5ad60fa","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"adbcb34f03abb89e681a5907c4c3ce4bf224991d","status":"affected","versionType":"git"},{"version":"98e4da8ca301e062d79ae168c67e56f3c3de3ce4","lessThan":"8fc6056dcf79937c46c97fa4996cda65956437a9","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/node.c","include/linux/f2fs_fs.h"],"versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","status":"unaffected","versionType":"semver"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.140","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.58","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.8","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.12.58"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.17.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.8","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/88b2ddb0c4f1dc874d4598e78cc830c64315ed86"},{"url":"https://git.kernel.org/stable/c/9337ed5e777e1c19854928cba7a8131dd00e611b"},{"url":"https://git.kernel.org/stable/c/6b9525596a83cd5b7bbc2c7bd5f9ad9cf5ad60fa"},{"url":"https://git.kernel.org/stable/c/adbcb34f03abb89e681a5907c4c3ce4bf224991d"},{"url":"https://git.kernel.org/stable/c/8fc6056dcf79937c46c97fa4996cda65956437a9"}],"title":"f2fs: fix to detect potential corrupted nid in free_nid_list","x_generator":{"engine":"bippy-1.2.0"}}}}