An, unfixed f2fs file system in the Linux kernel contains a use‑after‑free bug in the f2fs_write_end_io() routine. The flaw originates from a race condition that can surface during loop device operations, where a checkpoint thread wake‑up occurs after a folio’s writeback finalization, while the superblock structure has already been freed. The resulting misuse of freed memory can corrupt kernel data structures, crash the system, or in theory provide a vector for arbitrary code execution. This is a CWE‑416 condition operating within the kernel address space, thus representing a high‑risk vulnerability.

All Linux kernel builds that include the f2fs module without the recent patch are vulnerable. The patch is applied to any kernel version that shipped a pre‑2026‑23234 f2fs implementation; therefore every distribution maintaining a standard kernel with f2fs enabled is at risk.

The CVSS score of 7.8 denotes a high severity. The EPSS score of less than 1 % indicates that public exploitation is considered unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires local access that can trigger the race, such as mounting an f2fs filesystem on a loop device or exercising privileged I/O operations. The race can be induced by manipulating the timing between the worker thread, the loop process work, and the checkpoint thread. Although the exact mechanics are not fully detailed, sufficient contextual information suggests that exploitation would necessitate privileged code execution or the ability to perform privileged device operations.