CVE-2026-31715: f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix UAF caused by decrementing sbi->nrpages[] in f2fswriteendio()
The xfstests case "generic/107" and syzbot have both reported a NULL pointer dereference.
The concurrent scenario that triggers the panic is as follows:
F2FSWBCPDATA write callback umount - f2fswritecheckpoint - f2fswaitonallpages(sbi, F2FSWBCPDATA) - blkmqendrequest - bioendio - f2fswriteendio : decpagecount(sbi, F2FSWBCPDATA) : wakeup(&sbi->cpwait) - killf2fssuper - killblocksuper - f2fsputsuper : iput(sbi->nodeinode) : sbi->nodeinode = NULL : f2fsinwarmnodelist - isnodefolio // sbi->nodeinode is NULL and panic
The root cause is that f2fsputsuper() calls iput(sbi->nodeinode) and sets sbi->nodeinode to NULL after sbi->nrpages[F2FSWBCPDATA] is decremented to zero. As a result, f2fsinwarmnodelist() may dereference a NULL nodeinode when checking whether a folio belongs to the node inode, leading to a panic.
This patch fixes the issue by calling f2fsinwarmnodelist() before decrementing sbi->nrpages[F2FSWBCPDATA], thus preventing the use-after-free condition.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31715?
CVE-2026-31715 is classified as a high-severity vulnerability due to the potential for a use-after-free condition.
How do I fix CVE-2026-31715?
To fix CVE-2026-31715, update your Linux kernel to versions above 6.18.25 or 6.19, or apply the relevant patches if available.
What systems are affected by CVE-2026-31715?
CVE-2026-31715 affects Linux kernel versions from 4.19 to 6.18.25, and 6.19 to 7.1-rc1.
What does CVE-2026-31715 exploit?
CVE-2026-31715 exploits a use-after-free vulnerability in the f2fs file system that can lead to undefined behavior.
Is CVE-2026-31715 publicly known?
Yes, CVE-2026-31715 is publicly known and has been reported through xfstests and syzbot.