CVE-2026-63812
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388: F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache. This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Undergoing Analysis
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-07-19 12:16:54.137000
Last modified
2026-10-30 13:19:17.433000
View original CVE JSON
{
"id": "CVE-2026-63812",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-07-19T12:16:54.137",
"lastModified": "2026-10-30T13:19:17.433",
"vulnStatus": "Undergoing Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()\n\nWhen __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does\nnot reset the length of the largest extent to 0 and update the inode\nfolio. Since modifications to the extent tree are disallowed afterward,\nthe cached largest extent may become stale. This can trigger the\nfollowing error in xfstests generic/388:\n\nF2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix\n\nIn the f2fs_drop_inode path, __destroy_extent_node() does not need to\nguarantee that et->node_cnt is 0, because concurrency with writeback\nis expected in this path, and writeback may update the extent cache.\n\nThis patch reverts commit ed78aeebef05 (\"f2fs: fix node_cnt race between\nextent node destroy and writeback\"), and remove the unnecessary zero\ncheck of et->node_cnt."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/f2fs/extent_cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "42dd1c91f993431d0b399502479d00e6ad1bca71",
"lessThan": "7e4d8f98be63f98856a5176b9188dada6e7ba9ee",
"versionType": "git",
"status": "affected"
},
{
"version": "ab1eaf9d5c99042f5b0243bf67a06283a4c0757f",
"lessThan": "58a5deb220bcac4c73bf58954c0845644c997487",
"versionType": "git",
"status": "affected"
},
{
"version": "b0e4395870eb3441ddc959f6710b5f6ca61aff26",
"lessThan": "20190e498057997532c7f186d081011f18e0a462",
"versionType": "git",
"status": "affected"
},
{
"version": "ed78aeebef05212ef7dca93bd931e4eff67c113f",
"lessThan": "edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7",
"versionType": "git",
"status": "affected"
},
{
"version": "ed78aeebef05212ef7dca93bd931e4eff67c113f",
"lessThan": "1f70ddb28a3c71df124da5fa4040c808116d6bb9",
"versionType": "git",
"status": "affected"
},
{
"version": "b00e6950da9c0e4986f6e93c875d2b9184bdb220",
"versionType": "git",
"status": "affected"
},
{
"version": "0559a0e962aacbb47519e26ee663be04b72dcb92",
"versionType": "git",
"status": "affected"
},
{
"version": "6.6.140",
"lessThan": "6.6.144",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.12.88",
"lessThan": "6.12.95",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.18.30",
"lessThan": "6.18.38",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.1.191",
"lessThan": "6.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0.7",
"lessThan": "7.1",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/f2fs/extent_cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "7.1",
"status": "affected"
},
{
"version": "0",
"lessThan": "7.1",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.144",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.95",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.38",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.3",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f70ddb28a3c71df124da5fa4040c808116d6bb9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/20190e498057997532c7f186d081011f18e0a462",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/58a5deb220bcac4c73bf58954c0845644c997487",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7e4d8f98be63f98856a5176b9188dada6e7ba9ee",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}