In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on block address in f2fs_do_zero_range() As Yanming reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215894 I have encountered a bug in F2FS file system in kernel v5.17. I have uploaded the system call sequence as case.c, and a fuzzed image can be found in google net disk The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can reproduce the bug by running the following commands: kernel BUG at fs/f2fs/segment.c:2291! Call Trace: f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0 ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in inode will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause panic when updating SIT with invalid blkaddr. Let's fix the issue by adding sanity check on block address before updating SIT table with it.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989361 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

    As Yanming reported in bugzilla:

    https://bugzilla.kernel.org/show_bug.cgi?id=215894

    I have encountered a bug in F2FS file system in kernel v5.17.

    I have uploaded the system call sequence as case.c, and a fuzzed image can     be found in google net disk

    The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can     reproduce the bug by running the following commands:

    kernel BUG at fs/f2fs/segment.c:2291!     Call Trace:
     f2fs_invalidate_blocks+0x193/0x2d0      f2fs_fallocate+0x2593/0x4a70      vfs_fallocate+0x2a5/0xac0      ksys_fallocate+0x35/0x70
     __x64_sys_fallocate+0x8e/0xf0      do_syscall_64+0x3b/0x90      entry_SYSCALL_64_after_hwframe+0x44/0xae

    The root cause is, after image was fuzzed, block mapping info in inode     will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause     panic when updating SIT with invalid blkaddr.

    Let's fix the issue by adding sanity check on block address before updating     SIT table with it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989609 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    f2fs: fix to do sanity check on block address in f2fs_do_zero_range()

    As Yanming reported in bugzilla:

    https://bugzilla.kernel.org/show_bug.cgi?id=215894

    I have encountered a bug in F2FS file system in kernel v5.17.

    I have uploaded the system call sequence as case.c, and a fuzzed image can     be found in google net disk

    The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can     reproduce the bug by running the following commands:

    kernel BUG at fs/f2fs/segment.c:2291!     Call Trace:
     f2fs_invalidate_blocks+0x193/0x2d0      f2fs_fallocate+0x2593/0x4a70      vfs_fallocate+0x2a5/0xac0      ksys_fallocate+0x35/0x70
     __x64_sys_fallocate+0x8e/0xf0      do_syscall_64+0x3b/0x90      entry_SYSCALL_64_after_hwframe+0x44/0xae

    The root cause is, after image was fuzzed, block mapping info in inode     will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause     panic when updating SIT with invalid blkaddr.

    Let's fix the issue by adding sanity check on block address before updating     SIT table with it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - f2fs: fix to do sanity check on block address in f2fs_do_zero_range() As Yanming reported in bugzilla:
    https://bugzilla.kernel.org/show_bug.cgi?id=215894 I have encountered a bug in F2FS file system in kernel     v5.17. I have uploaded the system call sequence as case.c, and a fuzzed image can be found in google net     disk The kernel should enable CONFIG_KASAN=y and CONFIG_KASAN_INLINE=y. You can reproduce the bug by     running the following commands: kernel BUG at fs/f2fs/segment.c:2291! Call Trace:
    f2fs_invalidate_blocks+0x193/0x2d0 f2fs_fallocate+0x2593/0x4a70 vfs_fallocate+0x2a5/0xac0     ksys_fallocate+0x35/0x70 __x64_sys_fallocate+0x8e/0xf0 do_syscall_64+0x3b/0x90     entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is, after image was fuzzed, block mapping info in     inode will be inconsistent with SIT table, so in f2fs_fallocate(), it will cause panic when updating SIT     with invalid blkaddr. Let's fix the issue by adding sanity check on block address before updating SIT     table with it. (CVE-2022-49363)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
275906	TencentOS Server 4: kernel (TSSA-2025:0346)	Nessus	Tencent Local Security Checks	high
273667	Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989361)	Nessus	Unity Linux Local Security Checks	medium
273130	Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989609)	Nessus	Unity Linux Local Security Checks	medium
225779	Linux Distros Unpatched Vulnerability : CVE-2022-49363	Nessus	Misc.	medium

Detections

Analytics

CVE-2022-49363

medium

Tenable Plugins

high

medium

medium

medium