A race condition between extent node destruction and writeback in the Linux f2fs file system can leave the internal counter node_cnt non‑zero while an extent node is destroyed. The f2fs_bug_on assertion is then triggered inside __destroy_extent_node(), causing a kernel panic and a complete loss of availability for the affected machine. The flaw is a consistency error that manifests only during concurrent file system activity and does not allow direct data exfiltration.

All Linux kernels that ship the f2fs driver and have not yet incorporated the commit adding the FI_NO_EXTENT guard are potentially vulnerable. The patch series referenced by commit identifiers 0559a0e962aacbb47519e26ee663be04b72dcb92 and related changes address this flaw. Users should verify that their kernel version contains those commits or a later revision.

Exploitation requires a local attacker who can initiate filesystem operations that drop an inode while a background writeback thread is running. The race condition depends on precise timing, making the attack vector difficult to predict. The EPSS score is less than 1%, indicating a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local file system activity, although the exact attacker model is not explicitly stated in the input.