The Linux kernel's f2fs filesystem had a vulnerability where f2fs_acl_count() only validated the aggregate ACL xattr length, allowing malformed ACL entries (ACL_USER or ACL_GROUP) to be placed in slots too small to hold full entries. The function f2fs_acl_from_disk() then read the e_id field without verifying the full entry size, causing out-of-bounds memory reads. The patch introduced validation requiring a short entry before reading e_tag and e_perm, and a full entry before reading e_id for ACL_USER and ACL_GROUP entries. This prevents the kernel address sanitizer (KASAN) slab-out-of-bounds error and potential memory corruption.

This vulnerability could cause kernel memory corruption due to out-of-bounds reads when processing malformed ACL entries on f2fs filesystems. While no direct exploit in the wild is known, such memory corruption could lead to system instability or potential privilege escalation if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by adding validation checks in f2fs_acl_from_disk(). Users should monitor official Linux kernel advisories and apply updates when available to mitigate this issue.