CVE-2025-38333 f2fs: fix to bail out in get_new_segment()
A flaw in the Linux kernel's f2fs filesystem allows a local attacker to trigger a kernel warning and potential denial of service via inconsistent segment maps.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38333?
CVE-2025-38333 is a high-severity denial of service vulnerability in Linux kernel, published on 10 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to bail out in get_new_segment()
------------[ cut here ]------------ WARNING: CPU: 3 PID: 579 at fs/f2fs/segment.c:2832 new_curseg+0x5e8/0x6dc pc : new_curseg+0x5e8/0x6dc Call trace: new_curseg+0x5e8/0x6dc f2fs_allocate_data_block+0xa54/0xe28 do_write_page+0x6c/0x194 f2fs_do_write_node_page+0x38/0x78 __write_node_page+0x248/0x6d4 f2fs_sync_node_pages+0x524/0x72c f2fs_write_checkpoint+0x4bc/0x9b0 __checkpoint_and_complete_reqs+0x80/0x244 issue_checkpoint_thread+0x8c/0xec kthread+0x114/0x1bc ret_from_fork+0x10/0x20
get_new_segment() detects inconsistent status in between free_segmap and free_secmap, let's record such error into super block, and bail out get_new_segment() instead of continue using the segment.
Which versions are affected by CVE-2025-38333?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38333?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38333 being exploited?
There is no known exploitation of CVE-2025-38333 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-64889, BELL-CVE-2025-38333, DEBIAN-CVE-2025-38333, GHSA-9ff3-g52h-6rx4, ROOT-OS-DEBIAN-11-CVE-2025-38333, ROOT-OS-DEBIAN-12-CVE-2025-38333 and 3 more.