Executive brief
The Linux kernel's f2fs filesystem implementation has a bug in its logic for safely reclaiming storage space when shrinking a filesystem. During the shrink operation, the code fails to move certain in-memory data structures (curseg types) out of the target storage range, which can cause the filesystem to attempt writes to invalid locations after the range is truncated, resulting in system crashes or data corruption.
Technical details
This is a logic bug in the f2fs garbage collection code's free_segment_range() function. The curseg evacuation loop iterates only up to NR_CURSEG_PERSIST_TYPE (covering types 0-5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. Although these in-memory curseg types are not saved to the checkpoint header, they still occupy active physical segments at runtime. When a filesystem shrink operation truncates a storage range containing an active in-memory curseg, the incomplete evacuation allows subsequent writes to that curseg to perform out-of-bounds I/O on the truncated storage range. The fix expands the evacuation loop upper bound to NR_CURSEG_TYPE to ensure all curseg types are properly migrated. Local filesystem access is required to trigger this condition during a filesystem resize operation.
Affected products
- Linux Linux kernel all versions with f2fs support affected by commit d0b9e42ab615 onwards
Timeline
- 2026-09-16: disclosed
- 2026-08-21: patched