CVE-2025-68796

f2fs: fix to avoid updating zero-sized extent in extent cache

State: Published
Severity: Not scored
Published: Jan 13, 2026
Updated: May 11, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid updating zero-sized extent in extent cache

As syzbot reported:

F2FS-fs (loop0): __update_extent_tree_range: extent len is zero, type: 0, extent [0, 0, 0], age [0, 0] ------------[ cut here ]------------ kernel BUG at fs/f2fs/extent_cache.c:678! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__update_extent_tree_range+0x13bc/0x1500 fs/f2fs/extent_cache.c:678 Call Trace: <TASK> f2fs_update_read_extent_cache_range+0x192/0x3e0 fs/f2fs/extent_cache.c:1085 f2fs_do_zero_range fs/f2fs/file.c:1657 [inline] f2fs_zero_range+0x10c1/0x1580 fs/f2fs/file.c:1737 f2fs_fallocate+0x583/0x990 fs/f2fs/file.c:2030 vfs_fallocate+0x669/0x7e0 fs/open.c:342 ioctl_preallocate fs/ioctl.c:289 [inline] file_ioctl+0x611/0x780 fs/ioctl.c:-1 do_vfs_ioctl+0xb33/0x1430 fs/ioctl.c:576 __do_sys_ioctl fs/ioctl.c:595 [inline] __se_sys_ioctl+0x82/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f07bc58eec9

In error path of f2fs_zero_range(), it may add a zero-sized extent into extent cache, it should be avoided.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6e9619499f53b22ead972e476c0e8341c997d929 to before 9c07bd262c13ca922adad6e7613d48505f97f548Affected 6e9619499f53b22ead972e476c0e8341c997d929 to before 72c58a82e6fb7b327e8701f5786c70c3edc56188Affected 6e9619499f53b22ead972e476c0e8341c997d929 to before e50b81c50fcbe63f50405bb40f262162ff32af88Affected 6e9619499f53b22ead972e476c0e8341c997d929 to before efe3371001f50a2d6f746b50bdc6f9f26b2089ecAffected 6e9619499f53b22ead972e476c0e8341c997d929 to before 4f244c64efe628d277b916f47071adf480eb8646Affected 6e9619499f53b22ead972e476c0e8341c997d929 to before bac23833220a1f8fe8dfab7e16efa20ff64d7589Affected 6e9619499f53b22ead972e476c0e8341c997d929 to before 7c37c79510329cd951a4dedf3f7bf7e2b18dccecAffected
LinuxLinux	4.7Affected before 4.7Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.3 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

6e9619499f53b22ead972e476c0e8341c997d929 to before 9c07bd262c13ca922adad6e7613d48505f97f548Affected
6e9619499f53b22ead972e476c0e8341c997d929 to before 72c58a82e6fb7b327e8701f5786c70c3edc56188Affected
6e9619499f53b22ead972e476c0e8341c997d929 to before e50b81c50fcbe63f50405bb40f262162ff32af88Affected
6e9619499f53b22ead972e476c0e8341c997d929 to before efe3371001f50a2d6f746b50bdc6f9f26b2089ecAffected
6e9619499f53b22ead972e476c0e8341c997d929 to before 4f244c64efe628d277b916f47071adf480eb8646Affected
6e9619499f53b22ead972e476c0e8341c997d929 to before bac23833220a1f8fe8dfab7e16efa20ff64d7589Affected
6e9619499f53b22ead972e476c0e8341c997d929 to before 7c37c79510329cd951a4dedf3f7bf7e2b18dccecAffected

LinuxLinux

4.7Affected
before 4.7Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.3 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.