CVE-2026-63812 (GCVE-0-2026-63812)

Vulnerability from cvelistv5 – Published: 2026-07-19 12:02 – Updated: 2026-08-17 04:51
VLAI
Title
f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388: F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache. This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 42dd1c91f993431d0b399502479d00e6ad1bca71 , < 7e4d8f98be63f98856a5176b9188dada6e7ba9ee (git)
Affected: ab1eaf9d5c99042f5b0243bf67a06283a4c0757f , < 58a5deb220bcac4c73bf58954c0845644c997487 (git)
Affected: b0e4395870eb3441ddc959f6710b5f6ca61aff26 , < 20190e498057997532c7f186d081011f18e0a462 (git)
Affected: ed78aeebef05212ef7dca93bd931e4eff67c113f , < edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7 (git)
Affected: ed78aeebef05212ef7dca93bd931e4eff67c113f , < 1f70ddb28a3c71df124da5fa4040c808116d6bb9 (git)
Affected: 0559a0e962aacbb47519e26ee663be04b72dcb92 (git)
Affected: 6.6.140 , < 6.6.144 (semver)
Affected: 6.12.88 , < 6.12.95 (semver)
Affected: 6.18.30 , < 6.18.38 (semver)
Affected: 7.0.7 , < 7.1 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 6.6.144 , ≤ 6.6.* (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.38 , ≤ 6.18.* (semver)
Unaffected: 7.1.3 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/extent_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7e4d8f98be63f98856a5176b9188dada6e7ba9ee",
              "status": "affected",
              "version": "42dd1c91f993431d0b399502479d00e6ad1bca71",
              "versionType": "git"
            },
            {
              "lessThan": "58a5deb220bcac4c73bf58954c0845644c997487",
              "status": "affected",
              "version": "ab1eaf9d5c99042f5b0243bf67a06283a4c0757f",
              "versionType": "git"
            },
            {
              "lessThan": "20190e498057997532c7f186d081011f18e0a462",
              "status": "affected",
              "version": "b0e4395870eb3441ddc959f6710b5f6ca61aff26",
              "versionType": "git"
            },
            {
              "lessThan": "edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7",
              "status": "affected",
              "version": "ed78aeebef05212ef7dca93bd931e4eff67c113f",
              "versionType": "git"
            },
            {
              "lessThan": "1f70ddb28a3c71df124da5fa4040c808116d6bb9",
              "status": "affected",
              "version": "ed78aeebef05212ef7dca93bd931e4eff67c113f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0559a0e962aacbb47519e26ee663be04b72dcb92",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.144",
              "status": "affected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.95",
              "status": "affected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.38",
              "status": "affected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "7.0.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/extent_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "6.6.140",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.12.88",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.18.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()\n\nWhen __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does\nnot reset the length of the largest extent to 0 and update the inode\nfolio. Since modifications to the extent tree are disallowed afterward,\nthe cached largest extent may become stale. This can trigger the\nfollowing error in xfstests generic/388:\n\nF2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix\n\nIn the f2fs_drop_inode path, __destroy_extent_node() does not need to\nguarantee that et-\u003enode_cnt is 0, because concurrency with writeback\nis expected in this path, and writeback may update the extent cache.\n\nThis patch reverts commit ed78aeebef05 (\"f2fs: fix node_cnt race between\nextent node destroy and writeback\"), and remove the unnecessary zero\ncheck of et-\u003enode_cnt."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local VFS filesystem activity (write, unlink, concurrent writeback) on an F2FS mount, most severely on Android/embedded userdata partitions where F2FS is the default local filesystem.\nAC:L - An attacker can reliably orchestrate the inode-eviction/writeback race by unlinking files while writeback is in progress on the same inode, controlling both sides of the concurrency window.\nPR:L - Triggering the race requires only unprivileged write access to files on a mounted F2FS filesystem (e.g., creating, writing, and unlinking files in one\u0027s own directory on Android /data), not real root or CAP_SYS_ADMIN.\nUI:N - Exploitation requires no action from a separate victim; the attacker drives the file I/O and unlink operations that provoke the stale extent-cache state.\nS:U - Impact is confined to kernel/filesystem integrity on the affected host; there is no cross-security-authority boundary such as VM escape or container-to-host breakout.\nC:H - Stale largest-extent metadata persisted to the on-disk inode can cause subsequent reads (after inode reload or inode-number reuse) to map logical file offsets to wrong physical blocks, disclosing data from other files or freed blocks.\nI:H - Incorrect on-disk extent metadata corrupts the inode-to-block mapping and can cause wrong data blocks to be associated with a file, constituting exploitable filesystem metadata corruption with integrity impact beyond a simple crash.\nA:H - The stale cache triggers sanity_check_extent_cache failures (as seen in xfstests generic/388), f2fs_handle_error(ERROR_CORRUPTED_INODE), and potential kernel BUG_ON via f2fs_bug_on when CONFIG_F2FS_CHECK_FS is enabled, all causing denial of filesystem or kernel service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:19.062Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7e4d8f98be63f98856a5176b9188dada6e7ba9ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/58a5deb220bcac4c73bf58954c0845644c997487"
        },
        {
          "url": "https://git.kernel.org/stable/c/20190e498057997532c7f186d081011f18e0a462"
        },
        {
          "url": "https://git.kernel.org/stable/c/edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f70ddb28a3c71df124da5fa4040c808116d6bb9"
        }
      ],
      "title": "f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63812",
    "datePublished": "2026-07-19T12:02:13.606Z",
    "dateReserved": "2026-07-19T07:54:57.013Z",
    "dateUpdated": "2026-08-17T04:51:19.062Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63812",
      "date": "2026-09-21",
      "epss": "0.00175",
      "percentile": "0.07284"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-12T23:54:32.000Z",
      "cve": "CVE-2026-63812",
      "id": "msrc_CVE-2026-63812",
      "initial_release_date": "2026-07-20T01:07:14.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63812.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/extent_cache.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7e4d8f98be63f98856a5176b9188dada6e7ba9ee",
                    "status": "affected",
                    "version": "42dd1c91f993431d0b399502479d00e6ad1bca71",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "58a5deb220bcac4c73bf58954c0845644c997487",
                    "status": "affected",
                    "version": "ab1eaf9d5c99042f5b0243bf67a06283a4c0757f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "20190e498057997532c7f186d081011f18e0a462",
                    "status": "affected",
                    "version": "b0e4395870eb3441ddc959f6710b5f6ca61aff26",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7",
                    "status": "affected",
                    "version": "ed78aeebef05212ef7dca93bd931e4eff67c113f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1f70ddb28a3c71df124da5fa4040c808116d6bb9",
                    "status": "affected",
                    "version": "ed78aeebef05212ef7dca93bd931e4eff67c113f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "0559a0e962aacbb47519e26ee663be04b72dcb92",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.144",
                    "status": "affected",
                    "version": "6.6.140",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.95",
                    "status": "affected",
                    "version": "6.12.88",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18.38",
                    "status": "affected",
                    "version": "6.18.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "affected",
                    "version": "7.0.7",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/extent_cache.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.144",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.95",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.38",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()\n\nWhen __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does\nnot reset the length of the largest extent to 0 and update the inode\nfolio. Since modifications to the extent tree are disallowed afterward,\nthe cached largest extent may become stale. This can trigger the\nfollowing error in xfstests generic/388:\n\nF2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix\n\nIn the f2fs_drop_inode path, __destroy_extent_node() does not need to\nguarantee that et-\u003enode_cnt is 0, because concurrency with writeback\nis expected in this path, and writeback may update the extent cache.\n\nThis patch reverts commit ed78aeebef05 (\"f2fs: fix node_cnt race between\nextent node destroy and writeback\"), and remove the unnecessary zero\ncheck of et-\u003enode_cnt."
          }
        ],
        "id": "CVE-2026-63812",
        "lastModified": "2026-08-17T05:17:18.290",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T12:16:54.137",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1f70ddb28a3c71df124da5fa4040c808116d6bb9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/20190e498057997532c7f186d081011f18e0a462"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/58a5deb220bcac4c73bf58954c0845644c997487"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7e4d8f98be63f98856a5176b9188dada6e7ba9ee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-05T14:05:49+00:00",
      "cve": "CVE-2026-63812",
      "id": "CVE-2026-63812",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63812.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-22T16:24:25Z",
      "cve": "CVE-2026-63812",
      "id": "CVE-2026-63812",
      "initial_release_date": "2026-07-19T17:34:53Z",
      "product_status:known_not_affected": "286",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63812",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63812.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.