CVE-2025-22127: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-22127 is a vulnerability discovered in the Linux kernel's F2FS (Flash-Friendly File System) implementation, specifically in the prepare_compress_overwrite() function. The vulnerability was reported by Jan Prusakowski and disclosed on April 16, 2025. The issue affects Linux kernel versions 6.14.0-rc3 and 6.12, particularly impacting systems using F2FS with compression enabled (NVD, RedHat).

The vulnerability manifests as a potential deadloop in the prepare_compress_overwrite() function of F2FS. When encountering IO errors while reading compressed cluster pages, the function enters a loop while holding the .writepages lock, which can block all other writeback tasks. The issue has been assigned a CVSS 3.1 score of 5.5 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a local attack vector with low attack complexity (RedHat).

The vulnerability can cause a kernel hang condition where the fsstress process becomes blocked in __f2fs_write_data_pages(), leading to system unavailability. This primarily affects the system's availability by blocking writeback tasks, which can result in significant system performance degradation (NVD).

The vulnerability requires local access and can be triggered when running with specific F2FS mount options, particularly when compression is enabled. The exploit conditions include using compression, extra attributes, and project quota options on the affected filesystem (RedHat).

The issue has been resolved through two main fixes: adding f2fs_handle_page_eio() in prepare_compress_overwrite() to detect IO errors, and implementing earlier detection of cp_error in f2fs_read_multi_pages(). These patches have been incorporated into the Linux kernel (NVD).