Executive brief
The Linux kernel's F2FS file system contains a bug in the redirty_blocks() function that can cause incorrect reference counting of memory pages (folios). When a page read fails but the page is already in cache, the cleanup code incorrectly decrements the reference count too many times, leading to memory corruption that triggers a "BUG: Bad page state" error during memory reclaim or cache drops. This can cause system instability and denial of service.
Technical details
The vulnerability is a reference counting error in the F2FS file system's redirty_blocks() function (fs/f2fs/file.c). The function pins folios using read_cache_folio(), then walks the range again with filemap_lock_folio() to redirty them and drop references. A recent change converted the cleanup loop to a do/while structure, but if read_cache_folio() fails before pinning anything, the cleanup loop still executes once. If readahead has already populated the failed folio, this extra iteration calls folio_put_refs(folio, 2) on a folio that was only pinned once, causing an over-decrement. The fix changes the cleanup from do/while to while loop, ensuring it only processes folios that were actually pinned. The vulnerability requires no network access and is triggered through normal file system operations.
Affected products
- Linux Linux kernel 5.10 and later (via commit 5951fee46bef)
Timeline
- 2026-09-16: disclosed
- 2026-08-03: patched: Upstream fix committed; backports to stable branches from 2026-09-11 onwards