Answer in brief
CVE-2025-40054 records a High severity (CVSS 7.8) vulnerability in f2fs: fix UAF issue in f2fs_merge_page_bio(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0b20fcec8651569935a10afe03fedc0b812d044e <01118321e0c8a5f3ece57d0d377bfc92d83cd210 || >=0b20fcec8651569935a10afe03fedc0b812d044e <edf7e9040fc52c922db947f9c6c36f07377c52ea | 01118321e0c8a5f3ece57d0d377bfc92d83cd210, edf7e9040fc52c922db947f9c6c36f07377c52ea |
| Linux/Linuxgeneric | 5.5 | Not reported |
| Linux/Linuxgeneric | >=0b20fcec8651569935a10afe03fedc0b812d044e <1f7b44b4a2b2939f08b279cbb9e6b5dcb8ffea32 || >=0b20fcec8651569935a10afe03fedc0b812d044e <e193d8953647c8b575830852aa5ea0995b98d2b1 || >=0b20fcec8651569935a10afe03fedc0b812d044e <410337c2301ae78a081e1b5ebbe8ec374fef4cb6 || >=0b20fcec8651569935a10afe03fedc0b812d044e <68e094232dfe5027c4fd2dcded93d2d6800bae04 || >=0b20fcec8651569935a10afe03fedc0b812d044e <7dd611131d82d7fc4212b555eb1103160bdad302 || >=0b20fcec8651569935a10afe03fedc0b812d044e <01118321e0c8a5f3ece57d0d377bfc92d83cd210 || >=0b20fcec8651569935a10afe03fedc0b812d044e <edf7e9040fc52c922db947f9c6c36f07377c52ea | 1f7b44b4a2b2939f08b279cbb9e6b5dcb8ffea32, e193d8953647c8b575830852aa5ea0995b98d2b1, 410337c2301ae78a081e1b5ebbe8ec374fef4cb6, 68e094232dfe5027c4fd2dcded93d2d6800bae04, 7dd611131d82d7fc4212b555eb1103160bdad302, 01118321e0c8a5f3ece57d0d377bfc92d83cd210, edf7e9040fc52c922db947f9c6c36f07377c52ea |
Published upstream
Oct 28, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF issue in f2fs_merge_page_bio() As JY reported in bugzilla [1], Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98 lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4 CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P B W OE 6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5 Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Workqueue: writeback wb_workfn (flush-254:49) Call trace: f2fs_is_cp_guaranteed+0x70/0x98 f2fs_inplace_write_data+0x174/0x2f4 f2fs_do_write_data_page+0x214/0x81c f2fs_write_single_data_page+0x28c/0x764 f2fs_write_data_pages+0x78c/0xce4 do_writepages+0xe8/0x2fc __writeback_single_inode+0x4c/0x4b4 writeback_sb_inodes+0x314/0x540 __writeback_inodes_wb+0xa4/0xf4 wb_writeback+0x160/0x448 wb_workfn+0x2f0/0x5dc process_scheduled_works+0x1c8/0x458 worker_thread+0x334/0x3f0 kthread+0x118/0x1ac ret_from_fork+0x10/0x20 [1] https://bugzilla.kernel.org/show_bug.cgi?id=220575 The panic was caused by UAF issue w/ below race condition: kworker - writepages - f2fs_write_cache_pages - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_merge_page_bio - add_inu_page : cache page #1 into bio & cache bio in io->bio_list - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_merge_page_bio - add_inu_page : cache page #2 into bio which is linked in io->bio_list write - f2fs_write_begin : write page #1 - f2fs_folio_wait_writeback - f2fs_submit_merged_ipu_write - f2fs_submit_write_bio : submit bio which inclues page #1 and #2 software IRQ - f2fs_write_end_io - fscrypt_free_bounce_page : freed bounced page which belongs to page #2 - inc_page_count( , WB_DATA_TYPE(data_folio), false) : data_folio points to fio->encrypted_page the bounced page can be freed before accessing it in f2fs_is_cp_guarantee() It can reproduce w/ below testcase: Run below script in shell #1: for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ -c "pwrite 0 32k" -c "fdatasync" Run below script in shell #2: for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \ -c "pwrite 0 32k" -c "fdatasync" So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after commit page into internal ipu cache.
Quoted source text, attributed separately from HOL analysis.