Executive brief
The Linux kernel's F2FS filesystem implementation has a flaw in its MOVE_RANGE file operation that allows local users to extend files beyond intended limits. By providing specially crafted input parameters, an attacker can bypass size validation checks and cause an inode to be extended with unchecked data offsets, potentially leading to file corruption or resource exhaustion.
Technical details
The vulnerability is an integer overflow and missing bounds check in the F2FS_IOC_MOVE_RANGE ioctl handler (fs/f2fs/file.c). The flaw occurs because __clone_blkaddrs() skips NULL_ADDR entries and returns success, allowing the caller to extend the destination inode with unvalidated pos_out + len values. When olen (length) is large, adding it to pos_out can overflow or bypass filesystem limits. The fix adds explicit overflow detection (olen > LLONG_MAX - pos_out) and calls inode_newsize_ok() to validate the new size before extending the destination inode. Attack requires local file access and unprivileged ioctl execution on an F2FS filesystem.
Affected products
- Linux Linux kernel Affected across multiple kernel versions; patch available in stable branches
Timeline
- 2026-09-16: disclosed: CVE published
- 2026-09-11: patched: Fix committed upstream
- 2026-09-21: other: Fix backported to stable kernel branches