The vulnerability in the Linux kernel's f2fs filesystem occurs when the flexible_inline_xattr feature is enabled. The on-disk i_inline_xattr_size is loaded without conditional checks, but its sanity check only applies if the inode has the FI_INLINE_XATTR flag. Inodes without this flag but with inline data or directory entries can retain attacker-controlled i_inline_xattr_size values. This leads to calculations of inode geometry (MAX_INLINE_DATA, NR_INLINE_DENTRY, addrs_per_page) that can become negative. Consequently, directory traversal code compares an unsigned bit position against a negative maximum, causing out-of-bounds reads during inline directory walks. The vulnerability can be triggered by mounting a crafted filesystem image and reading directories, potentially causing memory corruption. The resolution enforces validation of i_inline_xattr_size against maximum allowed sizes whenever the flexible_inline_xattr feature is active, ensuring values are within safe bounds.

The vulnerability allows an attacker to craft a malicious f2fs filesystem image that, when mounted and accessed, triggers out-of-bounds reads in kernel memory during directory traversal. This can lead to memory corruption and potentially impact system stability or security. There is no indication of known exploits in the wild. The impact is limited to systems using the f2fs filesystem with the flexible_inline_xattr feature enabled.

A fix is available that validates the i_inline_xattr_size field against maximum allowed sizes whenever the flexible_inline_xattr feature is enabled. Users should apply the official Linux kernel updates that include this validation to mitigate the vulnerability. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or distribution security updates for the relevant patches.