In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on sbi->totalvalidblock_count
syzbot reported a f2fs bug as below:
------------[ cut here ]------------ kernel BUG at fs/f2fs/f2fs.h:2521! RIP: 0010:decvalidblockcount+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521 Call Trace: f2fstruncatedatablocksrange+0xc8c/0x11a0 fs/f2fs/file.c:695 truncatednode+0x417/0x740 fs/f2fs/node.c:973 truncatenodes+0x3ec/0xf50 fs/f2fs/node.c:1014 f2fstruncateinodeblocks+0x8e3/0x1370 fs/f2fs/node.c:1197 f2fsdotruncateblocks+0x840/0x12b0 fs/f2fs/file.c:810 f2fstruncateblocks+0x10d/0x300 fs/f2fs/file.c:838 f2fstruncate+0x417/0x720 fs/f2fs/file.c:888 f2fssetattr+0xc4f/0x12f0 fs/f2fs/file.c:1112 notifychange+0xbca/0xe90 fs/attr.c:552 dotruncate+0x222/0x310 fs/open.c:65 handletruncate fs/namei.c:3466 [inline] doopen fs/namei.c:3849 [inline] pathopenat+0x2e4f/0x35d0 fs/namei.c:4004 dofilpopen+0x284/0x4e0 fs/namei.c:4031 dosysopenat2+0x12b/0x1d0 fs/open.c:1429 dosysopen fs/open.c:1444 [inline] _dosyscreat fs/open.c:1522 [inline] _sesyscreat fs/open.c:1516 [inline] _x64syscreat+0x124/0x170 fs/open.c:1516 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xf3/0x230 arch/x86/entry/syscall_64.c:94
The reason is: in fuzzed image, sbi->totalvalidblock_count is inconsistent w/ mapped blocks indexed by inode, so, we should not trigger panic for such case, instead, let's print log and set fsck flag.
[
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-1d93bf18",
        "signature_type": "Function",
        "digest": {
            "length": 846.0,
            "function_hash": "139644813343794283200669889139515274937"
        },
        "target": {
            "file": "fs/f2fs/f2fs.h",
            "function": "dec_valid_block_count"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a324d77f7ea1a91d55c4b6ad970e3ac9ab6a20d",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-2679ab15",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "44721477264232907832948572401447173418",
                "57920155886261712754116006841540742007",
                "152101603358212769950214078255404578268",
                "36733708645388985387738168784974395843",
                "313974830139070770514802004812071430535"
            ]
        },
        "target": {
            "file": "fs/f2fs/f2fs.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b3f76592aed5a43c4d79375ac097acf975972b",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-2b29e600",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "44721477264232907832948572401447173418",
                "57920155886261712754116006841540742007",
                "152101603358212769950214078255404578268",
                "36733708645388985387738168784974395843",
                "313974830139070770514802004812071430535"
            ]
        },
        "target": {
            "file": "fs/f2fs/f2fs.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a324d77f7ea1a91d55c4b6ad970e3ac9ab6a20d",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-59b2e415",
        "signature_type": "Function",
        "digest": {
            "length": 846.0,
            "function_hash": "139644813343794283200669889139515274937"
        },
        "target": {
            "file": "fs/f2fs/f2fs.h",
            "function": "dec_valid_block_count"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49bc7bf38e42cfa642787e947f5721696ea73ac3",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-8912f266",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "44721477264232907832948572401447173418",
                "57920155886261712754116006841540742007",
                "152101603358212769950214078255404578268",
                "36733708645388985387738168784974395843",
                "313974830139070770514802004812071430535"
            ]
        },
        "target": {
            "file": "fs/f2fs/f2fs.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1b743c1955151bd392539b739a3ad155296be13",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-89214bdf",
        "signature_type": "Function",
        "digest": {
            "length": 846.0,
            "function_hash": "139644813343794283200669889139515274937"
        },
        "target": {
            "file": "fs/f2fs/f2fs.h",
            "function": "dec_valid_block_count"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25f3776b58c1c45ad2e50ab4b263505b4d2378ca",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-a1522b0c",
        "signature_type": "Function",
        "digest": {
            "length": 846.0,
            "function_hash": "139644813343794283200669889139515274937"
        },
        "target": {
            "file": "fs/f2fs/f2fs.h",
            "function": "dec_valid_block_count"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1b743c1955151bd392539b739a3ad155296be13",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-cc05951a",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "44721477264232907832948572401447173418",
                "57920155886261712754116006841540742007",
                "152101603358212769950214078255404578268",
                "36733708645388985387738168784974395843",
                "313974830139070770514802004812071430535"
            ]
        },
        "target": {
            "file": "fs/f2fs/f2fs.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05872a167c2cab80ef186ef23cc34a6776a1a30c",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-db59d9d0",
        "signature_type": "Function",
        "digest": {
            "length": 846.0,
            "function_hash": "139644813343794283200669889139515274937"
        },
        "target": {
            "file": "fs/f2fs/f2fs.h",
            "function": "dec_valid_block_count"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b3f76592aed5a43c4d79375ac097acf975972b",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-e5f6182c",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "44721477264232907832948572401447173418",
                "57920155886261712754116006841540742007",
                "152101603358212769950214078255404578268",
                "36733708645388985387738168784974395843",
                "313974830139070770514802004812071430535"
            ]
        },
        "target": {
            "file": "fs/f2fs/f2fs.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25f3776b58c1c45ad2e50ab4b263505b4d2378ca",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-e8b693c3",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "44721477264232907832948572401447173418",
                "57920155886261712754116006841540742007",
                "152101603358212769950214078255404578268",
                "36733708645388985387738168784974395843",
                "313974830139070770514802004812071430535"
            ]
        },
        "target": {
            "file": "fs/f2fs/f2fs.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49bc7bf38e42cfa642787e947f5721696ea73ac3",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2025-38163-f29df7aa",
        "signature_type": "Function",
        "digest": {
            "length": 846.0,
            "function_hash": "139644813343794283200669889139515274937"
        },
        "target": {
            "file": "fs/f2fs/f2fs.h",
            "function": "dec_valid_block_count"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05872a167c2cab80ef186ef23cc34a6776a1a30c",
        "deprecated": false
    }
]