CVE-2025-71107 f2fs: ensure node page reads complete before f2fs_put_super() finishes
A race condition in the Linux kernel f2fs filesystem can cause a kernel crash during unmount, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71107?
CVE-2025-71107 is a medium-severity vulnerability in Linux kernel, published on 14 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: ensure node page reads complete before f2fs_put_super() finishes
Xfstests generic/335, generic/336 sometimes crash with the following message:
F2FS-fs (dm-0): detect filesystem reference count leak during umount, type: 9, count: 1 ------------[ cut here ]------------ kernel BUG at fs/f2fs/super.c:1939! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 609351 Comm: umount Tainted: G W 6.17.0-rc5-xfstests-g9dd1835ecda5 #1 PREEMPT(none) Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_put_super+0x3b3/0x3c0 Call Trace: <TASK> generic_shutdown_super+0x7e/0x190 kill_block_super+0x1a/0x40 kill_f2fs_super+0x9d/0x190 deactivate_locked_super+0x30/0xb0 cleanup_mnt+0xba/0x150 task_work_run+0x5c/0xa0 exit_to_user_mode_loop+0xb7/0xc0 do_syscall_64+0x1ae/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> ---[ end trace 0000000000000000 ]---
It appears that sometimes it is possible that f2fs_put_super() is called before all node page reads are completed. Adding a call to f2fs_wait_on_all_pages() for F2FS_RD_NODE fixes the problem.
Weakness: CWE-476
Which versions are affected by CVE-2025-71107?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71107?
Apply the vendor's patch.
Is CVE-2025-71107 being exploited?
There is no known exploitation of CVE-2025-71107 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71107, DEBIAN-CVE-2025-71107, GHSA-mcmw-vr9c-grh2, ROOT-OS-DEBIAN-13-CVE-2025-71107, ROOT-OS-UBUNTU-2204-CVE-2025-71107, ROOT-OS-UBUNTU-2404-CVE-2025-71107 and 1 more.