A race condition in the f2fs filesystem allows a use‑after‑free of the superblock information (sbi) structure during the completion of compressed writeback operations. The bug occurs when the write‑back path decrements a counter that can unblock an unmount, which in turn frees the sbi before the write‑back callback finishes. The callback then accesses freed memory. This memory corruption can lead to unpredictable kernel behavior, crashes, or, if an attacker can trigger the scenario, arbitrary code execution in kernel mode. The vulnerability is specific to the f2fs_compress_write_end_io() routine and is similar to a previously fixed race in f2fs_write_end_io(). Based on the description, it is inferred that the race can be induced by coordinating writeback and unmount operations, which may require local access.

All Linux kernel releases that contain f2fs before the patch that moves the dec_page_count() call after page_array_free(). The affected code path is part of the f2fs filesystem layer and affects all systems using compiled‑in or dynamically loaded f2fs modules.

The CVSS Score of 7.8 indicates high severity, while the EPSS score is <1%, implying a very low probability of exploitation. The CWE identifiers for this vulnerability are 416 (Use After Free) and 825 (Uncontrolled Memory Reference). The vulnerability is not listed in the CISA KEV catalog. The attack requires local context that can exploit a race between compressed writeback and unmount; therefore it is not publicly exploitable in a remote scenario. However, the use‑after‑free could allow privilege escalation to root or cause denial of service if the conditions can be arranged. Based on the description, it likely requires local execution privileges and is not a feasible remote attack vector. The overall risk is considered moderate to high for environments that rely on f2fs and perform unmounts while writeback is active.