The Linux kernel's f2fs filesystem recovery function f2fs_recover_orphan_inodes() previously trusted the orphan block entry_count value when replaying orphan inodes from the checkpoint pack. If this entry_count was corrupted to a value larger than F2FS_ORPHANS_PER_BLOCK, the recovery loop would read beyond the ino[] array, interpreting footer or subsequent data as inode numbers. This could cause the kernel to trigger f2fs_bug_on() and panic during mount. The fix involves validating the entry_count before processing entries, causing corrupted checkpoint data to fail the mount with -EFSCORRUPTED and setting ERROR_INCONSISTENT_ORPHAN in the superblock to record the corruption reason, aiding fsck in recovery.

An attacker with the ability to provide a crafted f2fs image can cause a kernel panic during mount on an unpatched system, leading to denial of service. The corruption causes the recovery process to read invalid memory, triggering a kernel bug check and system crash. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to validate the orphan inode entry_count during f2fs recovery. Systems should apply the official kernel updates that include this fix. Until patched, avoid mounting untrusted or potentially corrupted f2fs images to prevent kernel panic. Patch status is not explicitly confirmed in the provided data; check the Linux kernel vendor advisory for the current remediation status and apply updates accordingly.