{"id":"CVE-2026-53018","state":"PUBLISHED","title":"f2fs: avoid reading already updated pages during GC","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: avoid reading already updated pages during GC\n\nWe found the following issue during fuzz testing:\n\npage: refcount:3 mapcount:0 mapping:00000000b6e89c65 index:0x18b2dc pfn:0x161ba9\nmemcg:f8ffff800e269c00\naops:f2fs_meta_aops ino:2\nflags: 0x52880000000080a9(locked|waiters|uptodate|lru|private|zone=1|kasantag=0x4a)\nraw: 52880000000080a9 fffffffec6e17588 fffffffec0ccc088 a7ffff8067063618\nraw: 000000000018b2dc 0000000000000009 00000003ffffffff f8ffff800e269c00\npage dumped because: VM_BUG_ON_FOLIO(folio_test_uptodate(folio))\npage_owner tracks the page as allocated\n post_alloc_hook+0x58c/0x5ec\n prep_new_page+0x34/0x284\n get_page_from_freelist+0x2dcc/0x2e8c\n __alloc_pages_noprof+0x280/0x76c\n __folio_alloc_noprof+0x18/0xac\n __filemap_get_folio+0x6bc/0xdc4\n pagecache_get_page+0x3c/0x104\n do_garbage_collect+0x5c78/0x77a4\n f2fs_gc+0xd74/0x25f0\n gc_thread_func+0xb28/0x2930\n kthread+0x464/0x5d8\n ret_from_fork+0x10/0x20\n------------[ cut here ]------------\nkernel BUG at mm/filemap.c:1563!\n folio_end_read+0x140/0x168\n f2fs_finish_read_bio+0x5c4/0xb80\n f2fs_read_end_io+0x64c/0x708\n bio_endio+0x85c/0x8c0\n blk_update_request+0x690/0x127c\n scsi_end_request+0x9c/0xb8c\n scsi_io_completion+0xf0/0x250\n scsi_finish_command+0x430/0x45c\n scsi_complete+0x178/0x6d4\n blk_mq_complete_request+0xcc/0x104\n scsi_done_internal+0x214/0x454\n scsi_done+0x24/0x34\n\nwhich is similar to the problem reported by syzbot:\nhttps://syzkaller.appspot.com/bug?extid=3686758660f980b402dc\n\nThis case is consistent with the description in commit 9bf1a3f\n(\"f2fs: avoid GC causing encrypted file corrupted\"):\nPage 1 is moved from blkaddr A to blkaddr B by move_data_block, and after\nbeing written it is marked as uptodate. Then, Page 1 is moved from blkaddr\nB to blkaddr C, VM_BUG_ON_FOLIO was triggered in the endio initiated by\nra_data_block.\n\nThere is no need to read Page 1 again from blkaddr B, since it has already\nbeen updated. Therefore, avoid initiating I/O in this case.","publishedAt":"2026-06-24T16:29:28.051Z","updatedAt":"2026-10-30T12:26:30.098Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"ecf53b5c9ccba6e6a7db111722cc8bbfc92d4558","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"c260c874a6d578a45105f98089b1f0db5c6ff0a3","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"08423a9564d92e51505763b6b2f47b3da8b0a355","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"4623c251496b99c530ce225c05334f4eac8b933a","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"b663ebb8a340eae5442e605b6acd2cff5677f016","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"570e2ccc7cb35fe720106964e65060602d3d2ac4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/gc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/gc.c"]}],"references":["https://git.kernel.org/stable/c/ecf53b5c9ccba6e6a7db111722cc8bbfc92d4558","https://git.kernel.org/stable/c/c260c874a6d578a45105f98089b1f0db5c6ff0a3","https://git.kernel.org/stable/c/08423a9564d92e51505763b6b2f47b3da8b0a355","https://git.kernel.org/stable/c/4623c251496b99c530ce225c05334f4eac8b933a","https://git.kernel.org/stable/c/b663ebb8a340eae5442e605b6acd2cff5677f016","https://git.kernel.org/stable/c/570e2ccc7cb35fe720106964e65060602d3d2ac4"],"weaknesses":[],"ingestedAt":"2026-10-30T12:44:04.813Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/53xxx/CVE-2026-53018.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53018","state":"PUBLISHED","datePublished":"2026-06-24T16:29:28.051Z","dateUpdated":"2026-10-30T12:26:30.098Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-06-09T07:44:35.378Z"},"containers":{"cna":{"title":"f2fs: avoid reading already updated pages during GC","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: avoid reading already updated pages during GC\n\nWe found the following issue during fuzz testing:\n\npage: refcount:3 mapcount:0 mapping:00000000b6e89c65 index:0x18b2dc pfn:0x161ba9\nmemcg:f8ffff800e269c00\naops:f2fs_meta_aops ino:2\nflags: 0x52880000000080a9(locked|waiters|uptodate|lru|private|zone=1|kasantag=0x4a)\nraw: 52880000000080a9 fffffffec6e17588 fffffffec0ccc088 a7ffff8067063618\nraw: 000000000018b2dc 0000000000000009 00000003ffffffff f8ffff800e269c00\npage dumped because: VM_BUG_ON_FOLIO(folio_test_uptodate(folio))\npage_owner tracks the page as allocated\n post_alloc_hook+0x58c/0x5ec\n prep_new_page+0x34/0x284\n get_page_from_freelist+0x2dcc/0x2e8c\n __alloc_pages_noprof+0x280/0x76c\n __folio_alloc_noprof+0x18/0xac\n __filemap_get_folio+0x6bc/0xdc4\n pagecache_get_page+0x3c/0x104\n do_garbage_collect+0x5c78/0x77a4\n f2fs_gc+0xd74/0x25f0\n gc_thread_func+0xb28/0x2930\n kthread+0x464/0x5d8\n ret_from_fork+0x10/0x20\n------------[ cut here ]------------\nkernel BUG at mm/filemap.c:1563!\n folio_end_read+0x140/0x168\n f2fs_finish_read_bio+0x5c4/0xb80\n f2fs_read_end_io+0x64c/0x708\n bio_endio+0x85c/0x8c0\n blk_update_request+0x690/0x127c\n scsi_end_request+0x9c/0xb8c\n scsi_io_completion+0xf0/0x250\n scsi_finish_command+0x430/0x45c\n scsi_complete+0x178/0x6d4\n blk_mq_complete_request+0xcc/0x104\n scsi_done_internal+0x214/0x454\n scsi_done+0x24/0x34\n\nwhich is similar to the problem reported by syzbot:\nhttps://syzkaller.appspot.com/bug?extid=3686758660f980b402dc\n\nThis case is consistent with the description in commit 9bf1a3f\n(\"f2fs: avoid GC causing encrypted file corrupted\"):\nPage 1 is moved from blkaddr A to blkaddr B by move_data_block, and after\nbeing written it is marked as uptodate. Then, Page 1 is moved from blkaddr\nB to blkaddr C, VM_BUG_ON_FOLIO was triggered in the endio initiated by\nra_data_block.\n\nThere is no need to read Page 1 again from blkaddr B, since it has already\nbeen updated. Therefore, avoid initiating I/O in this case."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"ecf53b5c9ccba6e6a7db111722cc8bbfc92d4558","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"c260c874a6d578a45105f98089b1f0db5c6ff0a3","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"08423a9564d92e51505763b6b2f47b3da8b0a355","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"4623c251496b99c530ce225c05334f4eac8b933a","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"b663ebb8a340eae5442e605b6acd2cff5677f016","versionType":"git"},{"version":"6aa58d8ad20a3323f42274c25820a6f54192422d","status":"affected","lessThan":"570e2ccc7cb35fe720106964e65060602d3d2ac4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/gc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.19","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/gc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ecf53b5c9ccba6e6a7db111722cc8bbfc92d4558"},{"url":"https://git.kernel.org/stable/c/c260c874a6d578a45105f98089b1f0db5c6ff0a3"},{"url":"https://git.kernel.org/stable/c/08423a9564d92e51505763b6b2f47b3da8b0a355"},{"url":"https://git.kernel.org/stable/c/4623c251496b99c530ce225c05334f4eac8b933a"},{"url":"https://git.kernel.org/stable/c/b663ebb8a340eae5442e605b6acd2cff5677f016"},{"url":"https://git.kernel.org/stable/c/570e2ccc7cb35fe720106964e65060602d3d2ac4"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:26:30.098Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"6.18.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"7.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}