A race condition in the f2fs filesystem allows a use‑after‑free of the superblock information (sbi) structure during the completion of compressed writeback operations. The bug occurs when the write‑back path decrements a counter that can unblock an unmount, which in turn frees the sbi before the write‑back callback finishes. The callback then accesses freed memory. This memory corruption can lead to unpredictable kernel behavior, crashes, or, if an attacker can trigger the scenario, arbitrary code execution in kernel mode. The vulnerability is specific to the f2fs_compress_write_end_io() routine and is similar to a previously fixed race in f2fs_write_end_io(). Based on the description, it is inferred that the race can be induced by coordinating writeback and unmount operations, which may require local access.

All Linux kernel releases that contain f2fs before the patch that moves the dec_page_count() call after page_array_free(). The affected code path is part of the f2fs filesystem layer and affects all systems using compiled‑in or dynamically loaded f2fs modules.

No CVSS score or EPSS information is published for this vulnerability, and it is not listed in the CISA KEV catalog. The attack requires a local context that can exploit a race between compressed writeback and filesystem unmounts; it is therefore not publicly exploitable in a remote scenario. However, the use‑after‑free could allow privilege escalation to root or cause denial of service if an attacker can arrange the conditions. Based on the description, the vulnerability likely requires local execution privileges and is not a feasible remote attack vector. The overall risk is considered moderate to high for environments that rely on f2fs and perform unmounts while writeback is active.