CVE-2026-43349: f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid uninit-value access in f2fssanitychecknodefooter
syzbot reported a f2fs bug as below:
BUG: KMSAN: uninit-value in f2fssanitychecknodefooter+0x374/0xa20 fs/f2fs/node.c:1520 f2fssanitychecknodefooter+0x374/0xa20 fs/f2fs/node.c:1520 f2fsfinishreadbio+0xe1e/0x1d60 fs/f2fs/data.c:177 f2fsreadendio+0x6ab/0x2220 fs/f2fs/data.c:-1 bioendio+0x1006/0x1160 block/bio.c:1792 submitbionoacct+0x533/0x2960 block/blk-core.c:891 submitbio+0x57a/0x620 block/blk-core.c:926 blkcryptosubmitbio include/linux/blk-crypto.h:203 [inline] f2fssubmitreadbio+0x12c/0x360 fs/f2fs/data.c:557 f2fssubmitpagebio+0xee2/0x1450 fs/f2fs/data.c:775 readnodefolio+0x384/0x4b0 fs/f2fs/node.c:1481 getnodefolio+0x5db/0x15d0 fs/f2fs/node.c:1576 f2fsgetinodefolio+0x40/0x50 fs/f2fs/node.c:1623 doreadinode fs/f2fs/inode.c:425 [inline] f2fsiget+0x1209/0x9380 fs/f2fs/inode.c:596 f2fsfillsuper+0x8f5a/0xb2e0 fs/f2fs/super.c:5184 gettreebdevflags+0x6e6/0x920 fs/super.c:1694 gettreebdev+0x38/0x50 fs/super.c:1717 f2fsgettree+0x35/0x40 fs/f2fs/super.c:5436 vfsgettree+0xb3/0x5d0 fs/super.c:1754 fcmount fs/namespace.c:1193 [inline] donewmountfc fs/namespace.c:3763 [inline] donewmount+0x885/0x1dd0 fs/namespace.c:3839 pathmount+0x7a2/0x20b0 fs/namespace.c:4159 domount fs/namespace.c:4172 [inline] dosysmount fs/namespace.c:4361 [inline] sesysmount+0x704/0x7f0 fs/namespace.c:4338 x64sysmount+0xe4/0x150 fs/namespace.c:4338 x64syscall+0x39f0/0x3ea0 arch/x86/include/generated/asm/syscalls64.h:166 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x134/0xf80 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
The root cause is: in f2fsfinishreadbio(), we may access uninit data in folio if we failed to read the data from device into folio, let's add a check condition to avoid such issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-28.28~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-27.27 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-27.27.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-27.27.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.0.3-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Compensating control
Add a check in f2fs_finish_read_bio() to avoid accessing folio data when the read from the device fails, preventing uninitialized data from reaching f2fs_sanity_check_node_footer().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43349?
CVE-2026-43349 has a medium severity level due to potential uninitialized value access.
How do I fix CVE-2026-43349?
To fix CVE-2026-43349, ensure that you upgrade your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-43349?
CVE-2026-43349 is a memory access vulnerability specifically related to uninitialized values in the f2fs file system.
Which software is affected by CVE-2026-43349?
CVE-2026-43349 affects the Linux kernel, particularly the f2fs file system implementation.
What are the potential risks of CVE-2026-43349 if left unpatched?
If left unpatched, CVE-2026-43349 could lead to unpredictable behavior or crashes in systems utilizing the f2fs file system.