CVE-2026-43349: f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid uninit-value access in f2fssanitychecknodefooter
syzbot reported a f2fs bug as below:
BUG: KMSAN: uninit-value in f2fssanitychecknodefooter+0x374/0xa20 fs/f2fs/node.c:1520 f2fssanitychecknodefooter+0x374/0xa20 fs/f2fs/node.c:1520 f2fsfinishreadbio+0xe1e/0x1d60 fs/f2fs/data.c:177 f2fsreadendio+0x6ab/0x2220 fs/f2fs/data.c:-1 bioendio+0x1006/0x1160 block/bio.c:1792 submitbionoacct+0x533/0x2960 block/blk-core.c:891 submitbio+0x57a/0x620 block/blk-core.c:926 blkcryptosubmitbio include/linux/blk-crypto.h:203 [inline] f2fssubmitreadbio+0x12c/0x360 fs/f2fs/data.c:557 f2fssubmitpagebio+0xee2/0x1450 fs/f2fs/data.c:775 readnodefolio+0x384/0x4b0 fs/f2fs/node.c:1481 getnodefolio+0x5db/0x15d0 fs/f2fs/node.c:1576 f2fsgetinodefolio+0x40/0x50 fs/f2fs/node.c:1623 doreadinode fs/f2fs/inode.c:425 [inline] f2fsiget+0x1209/0x9380 fs/f2fs/inode.c:596 f2fsfillsuper+0x8f5a/0xb2e0 fs/f2fs/super.c:5184 gettreebdevflags+0x6e6/0x920 fs/super.c:1694 gettreebdev+0x38/0x50 fs/super.c:1717 f2fsgettree+0x35/0x40 fs/f2fs/super.c:5436 vfsgettree+0xb3/0x5d0 fs/super.c:1754 fcmount fs/namespace.c:1193 [inline] donewmountfc fs/namespace.c:3763 [inline] donewmount+0x885/0x1dd0 fs/namespace.c:3839 pathmount+0x7a2/0x20b0 fs/namespace.c:4159 domount fs/namespace.c:4172 [inline] dosysmount fs/namespace.c:4361 [inline] sesysmount+0x704/0x7f0 fs/namespace.c:4338 x64sysmount+0xe4/0x150 fs/namespace.c:4338 x64syscall+0x39f0/0x3ea0 arch/x86/include/generated/asm/syscalls64.h:166 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x134/0xf80 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
The root cause is: in f2fsfinishreadbio(), we may access uninit data in folio if we failed to read the data from device into folio, let's add a check condition to avoid such issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If f2fs is not required, disable or blacklist the f2fs filesystem module (e.g., add 'blacklist f2fs' to /etc/modprobe.d/*.conf) to prevent loading/mounting of f2fs filesystems until a kernel containing the fix is installed.
Linux kernel (f2fs) module_load = disabled - Compensating control
Restrict or prevent mounting of f2fs filesystems and restrict access to untrusted block devices (for example, limit who can perform mounts, use mount namespaces, or enforce host hardening policies) until the kernel fix is applied.
- Operational
Install the upstream or vendor kernel update that contains the f2fs fix (the change to avoid uninit-value access in f2fs_sanity_check_node_footer) as soon as it is available, and reboot affected systems. Monitor vendor/kernel advisories for the specific patch and apply per normal maintenance procedures.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43349?
CVE-2026-43349 has a medium severity level due to potential uninitialized value access.
How do I fix CVE-2026-43349?
To fix CVE-2026-43349, ensure that you upgrade your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-43349?
CVE-2026-43349 is a memory access vulnerability specifically related to uninitialized values in the f2fs file system.
Which software is affected by CVE-2026-43349?
CVE-2026-43349 affects the Linux kernel, particularly the f2fs file system implementation.
What are the potential risks of CVE-2026-43349 if left unpatched?
If left unpatched, CVE-2026-43349 could lead to unpredictable behavior or crashes in systems utilizing the f2fs file system.