Executive brief
The Linux kernel's f2fs filesystem contains a race condition in how it handles large folios (multi-page memory objects) during invalidation. When a large folio is being removed from the page cache, the code releases it from memory before calculating the size of the invalidation range, allowing concurrent operations to shrink or free the folio. This leaves orphaned memory fragments in the filesystem's indexing structure, causing system livelocks, corrupted page state tracking, and potential data integrity issues in f2fs-based storage systems.
Technical details
The vulnerability is a use-after-put race condition in f2fs_get_read_data_folio() where folio_nr_pages() is called after f2fs_folio_put() has unlocked the folio and dropped the caller's reference count. This creates a window where concurrent truncate operations or folio split operations can shrink or deallocate the compound folio before the invalidation range size is determined. The resulting undersized invalidation range leaves orphaned sub-folios in the mapping's xarray index, causing xarray slot corruption, stale entries, and bad page state accounting when subsequent truncate and reclaim operations attempt to clean up. The fix involves capturing the folio size before releasing the refcount and lock. No patch date is specified in the advisory.
Affected products
- Linux Linux kernel v6.18 and later versions with f2fs
Timeline
- 2026-09-16: disclosed