Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-63816

f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink - f2fs_gc - gc_data_segment - ra_data_block(cow_inode) - mapping = F2FS_I(inode)->atomic_inode->i_mapping : f2fs_is_cow_file(cow_inode) is true - f2fs_evict_inode(atomic_inode) - clear_inode_flag(fi->cow_inode, FI_COW_FILE) - F2FS_I(fi->cow_inode)->atomic_inode = NULL ... - truncate_inode_pages_final(atomic_inode) - f2fs_grab_cache_folio(mapping) : create folio in atomic_inode->mapping - clear_inode(atomic_inode) - BUG_ON(atomic_inode->i_data.nrpages) We need to add a reference on fi->atomic_inode before using its mapping field during garbage collection, otherwise, it will cause UAF issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 3db1de0e582c358dd013f3703cd55b5fe4076436 to < 7d3ae21783e5914c1761ac7d63f882d3d70800e9affected
  • 3db1de0e582c358dd013f3703cd55b5fe4076436 to < 56038756aae68312df00d4aa1d97e51ef3aca725affected
  • 3db1de0e582c358dd013f3703cd55b5fe4076436 to < a499f77c06050a28c897bdbd86cd2f0721ae0743affected
  • 3db1de0e582c358dd013f3703cd55b5fe4076436 to < a805fec35c201c59643ddcde713bce4051c8ee27affected
  • 3db1de0e582c358dd013f3703cd55b5fe4076436 to < e0288584baa5dc41df4a829a023c4c1b33fe53d7affected
  • 6db52f1944417c2601182a591a704e2f119c5215affected
  • 5.18.18 to < 5.19affected

Linux Linux

Default version status: affected

  • 5.19affected
  • 0 to < 5.19unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.96 to ≤ 6.12.*unaffected
  • 6.18.39 to ≤ 6.18.*unaffected
  • 7.1.3 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References