Executive brief
The f2fs filesystem in Linux has an authorization check flaw when handling extended file attributes on idmapped mounts. The vulnerability allows an unrelated user to incorrectly modify file advisory attributes, while the legitimate owner may be wrongly denied permission. This affects containerized environments and systems using user namespace remapping.
Technical details
The f2fs_xattr_advise_set() function performs an owner capability check using inode_owner_or_capable() with a hardcoded no-op idmap (&nop_mnt_idmap) instead of the actual mount idmap passed by the VFS handler. On idmapped mounts, this causes the authorization logic to check the caller's fsuid against unmapped on-disk inode ownership rather than the namespace-mapped owner. An attacker can exploit this to set the "system.advise" xattr when they should be denied, or be denied when they should be allowed. The fix passes the correct idmap parameter to the owner check function. The vulnerability is present in affected Linux kernel versions and patches are available through stable kernel updates.
Affected products
- Linux Linux kernel multiple versions (f2fs support)
Timeline
- 2026-09-16: disclosed
- 2026-09-11: patched: Fix committed upstream; available in stable kernel updates