CVE-2025-40054 is a use-after-free vulnerability in the Linux kernel's f2fs filesystem, specifically in the f2fs_merge_page_bio() function. The flaw arises from a race condition during writeback operations involving encrypted pages, where a bounced page can be freed before it is accessed in f2fs_is_cp_guarantee(). This leads to a kernel NULL pointer dereference and potential system panic. The issue was reported via Bugzilla and fixed by changing the code to avoid using the freed encrypted page after committing it to the internal ipu cache. The vulnerability has a CVSS 3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector with low complexity, requiring low privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability can cause a kernel NULL pointer dereference resulting in a system panic (crash), impacting system availability. The vulnerability affects confidentiality and integrity due to the involvement of encrypted pages, potentially allowing unauthorized access or modification of sensitive data. The attack requires local access with low privileges and no user interaction, making it a high-severity local denial-of-service and potential data compromise risk.

A fix for this vulnerability has been applied in the Linux kernel source to avoid use-after-free conditions in f2fs_merge_page_bio(). Users and administrators should update their Linux kernel to a version that includes this patch. Since no explicit patch links or vendor advisories are provided, check the official Linux kernel repositories or distributions for the fixed kernel version. Patch status is not yet confirmed in this data — verify with the vendor or kernel maintainers for current remediation guidance.