The vulnerability in the Linux kernel's f2fs filesystem relates to the handling of the compressed cache inode number (F2FS_COMPRESS_INO()). This inode number uses max_nid as a synthetic inode number, which only exists when the compress_cache mount option is enabled. When compress_cache is disabled, max_nid is outside the valid inode range. However, due to is_meta_ino() treating F2FS_COMPRESS_INO() as a meta inode unconditionally, the inode range check in do_read_inode() was bypassed, allowing f2fs_iget() to instantiate a fake internal inode. The patch corrects this by gating the compressed cache inode case on the compress_cache option, so that with compression disabled, out-of-range inode numbers are rejected normally.

This vulnerability could allow a corrupted directory entry with an out-of-range inode number to bypass inode validation checks, potentially leading to the instantiation of a fake internal inode within the kernel's f2fs filesystem. This could cause undefined behavior or memory corruption within the kernel, impacting system stability or security. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to properly gate the compressed cache inode validation on the compress_cache mount option. Users should update their Linux kernel to a version that includes this fix once available. Patch status is not yet confirmed from the vendor advisory; check the official Linux kernel release notes or vendor advisories for the specific fixed version and apply updates accordingly.