In the Linux kernel, the f2fs filesystem contains a bug that causes swapfiles smaller than the filesystem section size (2 MB) and with fragmented layouts to be mapped incorrectly. The buggy logic in check_swap_activate() incorrectly treats the first unaligned extent as the last one, resulting in only the first portion of the swapfile being mapped. Subsequent swap writes then overwrite unrelated data on the underlying storage, corrupting application data, the f2fs metadata, or kernel memory. This corruption can trigger dm‑verity errors that reboot the device or cause the kernel to hang during boot.

The vulnerability affects all platforms running Linux kernel versions 6.6 and later when an F2FS filesystem is used as the swap pool. The issue is exposed only when the swapfile is smaller than 2 MB and has multiple non‑contiguous extents; it does not affect ext4 or other filesystems. Devices using Android (which commonly mount f2fs for userdata) are especially susceptible because the bug was discovered during a stress‑ng swap test on that environment. The patch is present in kernel releases after the commit that fixed the mapping logic, but older 6.6 snapshots prior to the fix remain vulnerable.

The vulnerability is rated CVSS 7.8, indicating high severity, but the EPSS score is below 1 % and the issue is not listed in CISA’s KEV catalog, implying a low likelihood of widespread exploitation. The attack vector requires local access to control swapfile creation and requires the victim’s system to be using f2fs with a small, fragmented swapfile. An attacker who can influence these conditions could cause data corruption, leading to loss of integrity, possible reboot, or boot hang. The exploit would operate silently until the corruption is detected by the system or by users observing failures.