CVE-2026-89830: f2fs: fix valid block count leak on data block allocation failure
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix valid block count leak on data block allocation failure
In allocatedatablock(), when allocating a new data block (dn->datablkaddr == NULLADDR), incvalidblockcount() is called first to increment totalvalidblockcount and iblocks. If the subsequent f2fsallocatedatablock() fails, the function returns the error directly without rolling back the already-incremented block counts, causing a permanent leak.
Fix this by calling decvalidblockcount() to undo the increment before returning the error. The condition oldblkaddr == NULLADDR precisely identifies the case where incvalidblockcount() was called.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The affected path is reached when F2FS allocates a new data block, identified by a NULL_ADDR old block address, and the subsequent data-block allocation fails. Existing-block allocation is not identified as the affected case in the provided information.
What state is left incorrect after an allocation failure?
The filesystem's total valid block count and the inode's i_blocks count remain incremented even though the new data block was not allocated. This creates a permanent valid-block-count leak.
How does the fix prevent the accounting leak?
On data-block allocation failure, the fix calls dec_valid_block_count() before returning the error when the old block address was NULL_ADDR. This reverses the earlier increment performed for the attempted new block allocation.