Executive brief
A race condition vulnerability was identified in the Linux kernel's f2fs file system. This issue occurs when the system is simultaneously trying to delete file information (inodes) and perform background data writing (writeback). In practice, this could lead to a system crash or kernel panic, potentially causing a denial of service for the affected machine.
Technical details
A race condition exists in the f2fs file system component of the Linux kernel between f2fs_destroy_extent_node() and concurrent kworker writeback. When f2fs_drop_inode() is called with the I_SYNC flag set, the destroy process may clear extent nodes while a concurrent writeback inserts new nodes into the same tree because the FI_NO_EXTENT flag was not set early enough. This results in a node count mismatch that triggers a f2fs_bug_on() call, leading to a kernel panic. Additionally, __update_extent_tree_range() failed to check the FI_NO_EXTENT flag for EX_BLOCK_AGE updates. The fix involves setting FI_NO_EXTENT under the extent tree lock and ensuring it is checked for both EX_READ and EX_BLOCK_AGE types.
Affected products
- Linux Linux kernel f2fs file system component
Timeline
- 2026-04-03: other: Patch authored
- 2026-05-28: advisory: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/0559a0e962aacbb47519e26ee663be04b72dcb92
- https://git.kernel.org/stable/c/42dd1c91f993431d0b399502479d00e6ad1bca71
- https://git.kernel.org/stable/c/ab1eaf9d5c99042f5b0243bf67a06283a4c0757f
- https://git.kernel.org/stable/c/b0e4395870eb3441ddc959f6710b5f6ca61aff26
- https://git.kernel.org/stable/c/ed78aeebef05212ef7dca93bd931e4eff67c113f