# CVE-2025-38218: f2fs: fix to do sanity check on sit_bitmap_size

> A missing sanity check in the Linux kernel's f2fs filesystem allows a local attacker to cause a kernel panic by mounting a specially crafted image.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 4 Jul 2025
- **Updated:** 5 Aug 2026
- **Also known as:** AZL-64677, BELL-CVE-2025-38218, DEBIAN-CVE-2025-38218, GHSA-944w-jxg5-jxvw, ROOT-OS-DEBIAN-11-CVE-2025-38218, ROOT-OS-DEBIAN-12-CVE-2025-38218, ROOT-OS-UBUNTU-2204-CVE-2025-38218, ROOT-OS-UBUNTU-2404-CVE-2025-38218, UBUNTU-CVE-2025-38218

## What is CVE-2025-38218?

CVE-2025-38218 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 4 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on sit_bitmap_size

w/ below testcase, resize will generate a corrupted image which
contains inconsistent metadata, so when mounting such image, it
will trigger kernel panic:

touch img
truncate -s $((512*1024*1024*1024)) img
mkfs.f2fs -f img $((256*1024*1024))
resize.f2fs -s -i img -t $((1024*1024*1024))
mount img /mnt/f2fs

------------[ cut here ]------------
kernel BUG at fs/f2fs/segment.h:863!
Oops: invalid opcode: 0000 [#1] SMP PTI
CPU: 11 UID: 0 PID: 3922 Comm: mount Not tainted 6.15.0-rc1+ #191 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:f2fs_ra_meta_pages+0x47c/0x490

Call Trace:
 f2fs_build_segment_manager+0x11c3/0x2600
 f2fs_fill_super+0xe97/0x2840
 mount_bdev+0xf4/0x140
 legacy_get_tree+0x2b/0x50
 vfs_get_tree+0x29/0xd0
 path_mount+0x487/0xaf0
 __x64_sys_mount+0x116/0x150
 do_syscall_64+0x82/0x190
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fdbfde1bcfe

The reaseon is:

sit_i->bitmap_size is 192, so size of sit bitmap is 192*8=1536, at maximum
there are 1536 sit blocks, however MAIN_SEGS is 261893, so that sit_blk_cnt
is 4762, build_sit_entries() -> current_sit_addr() tries to access
out-of-boundary in sit_bitmap at offset from [1536, 4762), once sit_bitmap
and sit_bitmap_mirror is not the same, it will trigger f2fs_bug_on().

Let's add sanity check in f2fs_sanity_check_ckpt() to avoid panic.

## Which versions are affected by CVE-2025-38218?

It affects 2 products.


Products: Debian Debian Linux, Linux kernel.

## How do I fix CVE-2025-38218?

Apply the vendor's patch.

## Is CVE-2025-38218 being exploited?

There is no known exploitation of CVE-2025-38218 in the wild and no public exploit code.

## Other vulnerabilities in Debian Debian Linux

- [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild)
- [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild)
- [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-38218 and fix it if it is affected.

What it is: CVE-2025-38218 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 4 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-38218 in the wild and no public exploit code.

Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-38218/ (Markdown: https://insights.sbomify.com/CVE-2025-38218/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-38218
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-38218
- OSV: https://osv.dev/vulnerability/CVE-2025-38218

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-38218/
Summaries are generated and may contain mistakes; the official description above is the record.