f2fs NodeFooter Bypass

Vulnerability analysis

During node folio writeback, f2fs runs a sanity check on the node footer to detect corruption and shut down the filesystem if the stored node ID does not match the expected one. The check was incorrectly passed the node ID extracted from the folio's own footer as the expected value, so it compared that value against itself and always passed — even when the footer was corrupted. This means corrupted node metadata written through the writeback path goes undetected, potentially propagating filesystem corruption. The fix passes the folio's page index (the correct expected node ID) to the sanity check so it actually validates the footer. The vulnerable code path is reached when an f2fs filesystem is mounted and node pages are written back; mounting f2fs requires real root (CAP_SYS_ADMIN in the init namespace), so an attacker must either supply a crafted f2fs image on removable media that gets auto-mounted by a privileged service or convince a root user to mount a malicious image.