Executive brief
The F2FS filesystem in the Linux kernel had a concurrency bug where updates to the critical_task_priority setting could race with filesystem remount or shutdown operations. This could lead to inconsistent internal state or kernel crashes during specific timing conditions when administrators change filesystem priority settings while the system is actively mounting or unmounting.
Technical details
This is a concurrency/synchronization bug in the F2FS filesystem driver's sysfs interface. The critical_task_priority sysfs attribute controls checkpoint and garbage collection thread scheduling state, but its store handler was not protected by the s_umount read lock that guards similar operations (gc_urgent, ckpt_thread_ioprio). This allows a race condition where a privileged user writing to critical_task_priority can race with remount or filesystem teardown paths that stop these kernel threads, potentially resulting in use-after-free or inconsistent thread state. The fix adds the attribute name to the thread_entry check so s_umount serialization is applied. Local administrative access is required to trigger this via sysfs writes.
Affected products
- Linux Linux kernel 5.10 and later (before patch date 2026-08-05)
Timeline
- 2026-09-16: disclosed
- 2026-08-05: patched: Upstream commit 8e4692c6c165e81b2cbb847d8da4b45a53483b33