CVE-2026-97534: f2fs: accurately adjust free_sections during free_segment_range
In the Linux kernel, the following vulnerability has been resolved:
f2fs: accurately adjust freesections during freesegmentrange
In freesegmentrange(), MAINSECS(sbi) is temporarily reduced by secs to restrict block allocation to the safe remaining main area while valid blocks in the truncated range are evacuated by GC.
However, FREEI(sbi)->freesections tracks the total number of free sections across the whole filesystem. If any sections within the truncated range were already free upon entering freesegmentrange(), failing to deduct them from freesections causes the filesystem to overestimate available free sections in the active, reduced main area. This leads to inconsistent free section accounting during GC data migration and can trigger unexpected allocation failures or assertion errors when space is tight.
Fix this by calculating the number of already-free sections in the truncated range, deducting them from freesections upon entering freesegmentrange(), and restoring them on exit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In f2fs free_segment_range(), calculate the number of sections in the truncated range that were already free on entry, deduct those sections from FREE_I(sbi)->free_sections while MAIN_SECS(sbi) is temporarily reduced by secs, restrict block allocation to the safe remaining main area while valid blocks are evacuated by GC, and restore the deducted free-section count on exit.
Event History
Frequently Asked Questions
When is this issue most likely to cause operational problems?
The issue can surface during garbage-collection data migration when free space is tight and the truncated range already contains free sections. It may result in unexpected allocation failures or assertion errors because the active main area appears to have more free sections than it actually does.
What is the immediate mitigation if an update cannot be applied?
No workaround or configuration-based mitigation is provided in the available information. The described risk is tied to GC activity under tight-space conditions, so maintaining sufficient free space may reduce the conditions under which the accounting inconsistency is triggered.