Executive brief
A race condition was identified in the Linux kernel's F2FS file system during atomic write operations. This flaw can lead to data inconsistency on the disk, potentially causing the system to fail to mount the file system or return errors after an unexpected power-off or reboot. This impacts system availability and the reliability of stored data.
Technical details
A race condition exists in the F2FS file system implementation within the Linux kernel due to inconsistent handling of the IS_CHECKPOINTED flag. During concurrent 'f2fs_ioc_commit_atomic_write' and 'f2fs_write_checkpoint' operations, a timing window allows a node folio to be marked and written with incorrect dentry information because the NAT entry flag is not yet updated. This results in an inconsistency where the block address is not NULL_ADDR after a checkpoint, leading to -EINVAL errors in 'f2fs_recover_inode_page' during subsequent mounts. The fix involves acquiring 'sbi->node_write' during atomic file fsync to ensure the IS_CHECKPOINTED flag correctly reflects the checkpoint status. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.7 to 6.1.164, 6.2 to 6.6.127, 6.7 to 6.12.74, 6.13 to 6.18.13, 6.19 to 6.19.3
Timeline
- 2026-03-18: disclosed: CVE published
- 2026-01-07: patched: Initial fix committed to mainline kernel
References
- https://git.kernel.org/stable/c/32bc3c9fe18881d50dd51fd5f26d19fe1190dc0d
- https://git.kernel.org/stable/c/75e19da068adf0dc5dd269dd157392434b9117d4
- https://git.kernel.org/stable/c/7633a7387eb4d0259d6bea945e1d3469cd135bbc
- https://git.kernel.org/stable/c/962c167b0f262b9962207fbeaa531721d55ea00e
- https://git.kernel.org/stable/c/bd66b4c487d5091d2a65d6089e0de36f0c26a4c7
- https://git.kernel.org/stable/c/ed81bc5885460905f9160e7b463e5708fd056324