CVE-2026-53368: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix fsck inconsistency caused by incorrect natentry flag usage
f2fsneeddentrymark() reads natentry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The scenario is as follows:
create & write & fsync 'file A' write checkpoint - f2fsdosyncfile // inline inode - f2fswriteinode // inode folio is dirty - f2fswritecheckpoint - f2fsflushmergedwrites - f2fssyncnodepages - f2fsfsyncnodepages // no dirty node - f2fsneedinodeblockupdate // return true - f2fsfsyncnodepages // inode dirtied - f2fsneeddentrymark //return true - f2fsflushnatentries - f2fswritecheckpoint end - writenodefolio // inode with DENTBITSHIFT set SPO, "fsck --dry-run" find inode has already checkpointed but still with DENTBITSHIFT set
The state observed by f2fsneeddentrymark() can differ from the state observed in writenodefolio() after acquiring sbi->nodewrite. The root cause is that the semantics of ISCHECKPOINTED and HASFSYNCEDINODE are only guaranteed after the checkpoint write has fully completed.
This patch moves setdentrymark() into writenodefolio() and protects it with the sbi->nodewrite lock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the f2fs implementation so set_dentry_mark() is moved into __write_node_folio(), and protect the state used by f2fs_need_dentry_mark() with the sbi->node_write lock to prevent nat_entry flag state from differing without mutual exclusion.
Linux f2fs (filesystem) set_dentry_mark placement = moved into __write_node_folio() - Compensating control
Ensure the storage/filesystem operation sequence follows the checkpoint semantics described: treat HAS_FSYNCED_INODE as only guaranteed after the checkpoint write has fully completed (i.e., after f2fs_write_checkpoint).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53368?
CVE-2026-53368 has a high severity score of 7.1 on the CVSS scale.
How do I fix CVE-2026-53368?
To fix CVE-2026-53368, update your Linux Kernel to the latest version where this vulnerability has been addressed.
What are the potential impacts of CVE-2026-53368?
CVE-2026-53368 could lead to data corruption due to incorrect inode block marking.
Which systems are affected by CVE-2026-53368?
CVE-2026-53368 affects systems running vulnerable versions of the Linux Kernel utilizing f2fs.
Can CVE-2026-53368 be exploited remotely?
CVE-2026-53368 requires local access to exploit, as it involves interactions with file system operations.