Executive brief
A vulnerability was identified in the Linux kernel's Flash-Friendly File System (F2FS) that could lead to file system corruption or data inconsistency. When the system attempts to clean up file data mappings, it may fail to properly clear cached information, resulting in stale data being used for future operations. This could cause system errors or require manual file system repairs using recovery tools.
Technical details
A vulnerability exists in the F2FS implementation within the Linux kernel due to incorrect handling of the FI_NO_EXTENT flag in the __destroy_extent_node() function. When this flag is set, the system fails to reset the length of the largest extent to zero or update the inode folio, leading to a stale cached largest extent. This inconsistency can be triggered during the f2fs_drop_inode path where concurrency with writeback operations occurs. An attacker or a specific sequence of file operations can trigger a sanity_check_extent_cache error, potentially leading to local denial of service or file system corruption. The fix involves reverting a previous problematic commit and ensuring proper state synchronization.
Affected products
- Linux Linux Kernel 6.6.140 to 6.6.144, 6.12.88 to 6.12.95, 6.18.30 to 6.18.38, 7.0.7 to 7.1
Timeline
- 2026-07-19: advisory
- 2026-07-19: disclosed
References
- https://git.kernel.org/stable/c/1f70ddb28a3c71df124da5fa4040c808116d6bb9
- https://git.kernel.org/stable/c/20190e498057997532c7f186d081011f18e0a462
- https://git.kernel.org/stable/c/58a5deb220bcac4c73bf58954c0845644c997487
- https://git.kernel.org/stable/c/7e4d8f98be63f98856a5176b9188dada6e7ba9ee
- https://git.kernel.org/stable/c/edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7