Executive brief
The f2fs file system in the Linux kernel has a bug that fails to properly clear dirty flags when node blocks become corrupted. When a node block's checksum fails or footer info is inconsistent, the corrupted data may be incorrectly marked as clean, potentially resulting in data loss or file system inconsistency. This affects systems using f2fs, commonly found on mobile devices and embedded systems.
Technical details
The vulnerability exists in the f2fs node reading logic (fs/f2fs/node.c) where, in the error path after detecting a corrupted node block, the code incorrectly calls folio_clear_uptodate() instead of clear_node_folio_dirty(). When a node block has a checksum mismatch or inconsistent footer information, the proper error handling should retain the dirty flag to ensure the inconsistent data is persisted to storage for recovery purposes. The bug causes affected data to be incorrectly treated as valid, potentially corrupting the file system state. The fix changes the error-path handling to call clear_node_folio_dirty() instead. This is a logic error in memory page flag management with no network attack vector; it is triggered only when corrupted blocks are read from storage.
Affected products
- Linux Linux kernel multiple versions with f2fs filesystem module
Timeline
- 2026-09-16: disclosed
- 2026-08-05: patched: Upstream patch commit 5b86eab84ac8e9289b5afc52ef88ab18ba5bacab
- 2026-09-11: other: Patch merged into stable tree