CVE-2026-63812

Summary

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()

When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388:

F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix

In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache.

This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux42dd1c91f993431d0b399502479d00e6ad1bca71 < 7e4d8f98be63f98856a5176b9188dada6e7ba9eeaffected
LinuxLinuxab1eaf9d5c99042f5b0243bf67a06283a4c0757f < 58a5deb220bcac4c73bf58954c0845644c997487affected
LinuxLinuxb0e4395870eb3441ddc959f6710b5f6ca61aff26 < 20190e498057997532c7f186d081011f18e0a462affected
LinuxLinuxed78aeebef05212ef7dca93bd931e4eff67c113f < edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7affected
LinuxLinuxed78aeebef05212ef7dca93bd931e4eff67c113f < 1f70ddb28a3c71df124da5fa4040c808116d6bb9affected
LinuxLinux0559a0e962aacbb47519e26ee663be04b72dcb92affected
LinuxLinux6.6.140 < 6.6.144affected
LinuxLinux6.12.88 < 6.12.95affected
LinuxLinux6.18.30 < 6.18.38affected
LinuxLinux7.0.7 < 7.1affected
LinuxLinux7.1affected
LinuxLinux0 < 7.1unaffected
LinuxLinux6.6.144 <= 6.6.*unaffected
LinuxLinux6.12.95 <= 6.12.*unaffected
LinuxLinux6.18.38 <= 6.18.*unaffected
LinuxLinux7.1.3 <= 7.1.*unaffected
LinuxLinux7.2-rc1 <= *unaffected

Weaknesses

References