In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix information leak in f2fs_move_inline_dirents()
When converting an inline directory to a regular one, f2fs is leaking uninitialized memory to disk because it doesn't initialize the entire directory block. Fix this by zero-initializing the block.
This bug was introduced by commit 4ec17d688d74 ("f2fs: avoid unneeded initializing when converting inline dentry"), which didn't consider the security implications of leaking uninitialized memory to disk.
This was found by running xfstest generic/435 on a KMSAN-enabled kernel.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Dec 10, 2025 | Dec 10, 2025 |
| Ubuntu | — | Upgrade linux-hwe-5.15Upgrade linux-gcp-fipsUpgrade linux-azure-fipsUpgrade linux-raspiUpgrade linux-gkeopUpgrade linux-iotUpgrade linux-aws-5.4Upgrade linux-azure-5.4Upgrade linux-aws-5.15Upgrade linuxUpgrade linux-azureUpgrade linux-hwe-5.4Upgrade linux-ibm-5.4Upgrade linux-nvidia-tegra-5.15Upgrade linux-awsUpgrade linux-lowlatencyUpgrade linux-aws-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-intel-iotgUpgrade linux-gcp-5.15Upgrade linux-gcp-5.4Upgrade linux-nvidia-tegraUpgrade linux-azure-fdeUpgrade linux-raspi-5.4Upgrade linux-kvmUpgrade linux-lowlatency-hwe-5.15Upgrade linux-oracle-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-realtimeUpgrade linux-ibmUpgrade linux-oracleUpgrade linux-nvidiaUpgrade linux-gcpUpgrade linux-gkeUpgrade linux-riscv-5.15Upgrade linux-bluefieldUpgrade linux-oracle-5.15Upgrade linux-fipsUpgrade linux-azure-5.15Upgrade linux-xilinx-zynqmp | Dec 11, 2025 | Dec 9, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 9, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub