The vulnerability stems from f2fs failing to zero out data that lies beyond the end of a file when the size of the file is increased. Because the partial maximum–sized page is not cleared, stale data that previously resided on the disk can be accessed after a remount or a system crash. This flaw allows a local attacker to read data that should have been unrecoverable, thereby exposing sensitive information that may include past file contents or other secrets stored on the same storage block. The weakness is essentially a failure to properly initialize memory and corresponds to conditions such as those described in CWE‑657.

All Linux systems that mount or use the f2fs file system are affected. The vulnerability applies to every kernel that has not yet incorporated the patch referenced in the Git commit logs and that may run with f2fs, including but not limited to embedded environments such as Android. No specific kernel version range is provided, so any release using the unpatched f2fs code is potentially vulnerable.

The CVSS score is not listed, and the EPSS score is unavailable, but the issue is not included in CISA’s KEV catalog. Consequently, the likelihood of exploitation in the wild is low; however, the vulnerability can be leveraged by an adversary with sufficient local privileges to trigger file system operations such as remounting, truncating, or writing to the device. The typical attack path would involve manipulating a file that resides on an f2fs volume, then causing the file to be extended across an unaligned EOF boundary, thereby exposing the residual data to the attacker. The patch ensures that the post‑EOF region is zeroed in page‑cache, marked dirty, and written back before the inode size is updated, which removes the information disclosure risk if applied in a timely manner.