01 Record

CVE-2025-40054

f2fs: fix UAF issue in f2fs_merge_page_bio()

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

f2fs: fix UAF issue in f2fs_merge_page_bio()

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.16% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 5.7% of scored records. A rank, not a probability.
NVD base score: 7.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Deferred. NVD last modified this record on 2026-10-19.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2025-10-28 11:48Z1 YR AGO
Last updated: 2026-08-23 12:45Z2 MO AGO
Reserved: 2025-04-16
Assigning CNA: Linux
Record state: PUBLISHED
Severity: High (CVSS 7.8)
CNA CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: 7c47a6796051d27ca860e7ad3757753828129e9d92bf225acc869715fef7a00e

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux0b20fcec8651569935a10afe03fedc0b812d044e to < 1f7b44b4a2b2939f08b279cbb9e6b5dcb8ffea32, 0b20fcec8651569935a10afe03fedc0b812d044e to < e193d8953647c8b575830852aa5ea0995b98d2b1, 0b20fcec8651569935a10afe03fedc0b812d044e to < 410337c2301ae78a081e1b5ebbe8ec374fef4cb6, 0b20fcec8651569935a10afe03fedc0b812d044e to < 68e094232dfe5027c4fd2dcded93d2d6800bae04, 0b20fcec8651569935a10afe03fedc0b812d044e to < 7dd611131d82d7fc4212b555eb1103160bdad302, 0b20fcec8651569935a10afe03fedc0b812d044e to < 01118321e0c8a5f3ece57d0d377bfc92d83cd210, 0b20fcec8651569935a10afe03fedc0b812d044e to < edf7e9040fc52c922db947f9c6c36f07377c52ea, 5.5—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/1f7b44b4a2b2939f08b279cbb9e6b5dcb8ffea32
git.kernel.orghttps://git.kernel.org/stable/c/e193d8953647c8b575830852aa5ea0995b98d2b1
git.kernel.orghttps://git.kernel.org/stable/c/410337c2301ae78a081e1b5ebbe8ec374fef4cb6
git.kernel.orghttps://git.kernel.org/stable/c/68e094232dfe5027c4fd2dcded93d2d6800bae04
git.kernel.orghttps://git.kernel.org/stable/c/7dd611131d82d7fc4212b555eb1103160bdad302
git.kernel.orghttps://git.kernel.org/stable/c/01118321e0c8a5f3ece57d0d377bfc92d83cd210
git.kernel.orghttps://git.kernel.org/stable/c/edf7e9040fc52c922db947f9c6c36f07377c52ea

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1
linux-6.12
Fixed in 6.12.107-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.105-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.17.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.