CVE-2024-26869

f2fs: fix to truncate meta inode pages forcely

State
Published
Severity
7.8 High
Published
Apr 17, 2024
Updated
Oct 30, 2026
Reserved
Feb 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to truncate meta inode pages forcely

Below race case can cause data corruption:

Thread A GC thread - gc_data_segment - ra_data_block - locked meta_inode page - f2fs_inplace_write_data - invalidate_mapping_pages : fail to invalidate meta_inode page due to lock failure or dirty|writeback status - f2fs_submit_page_bio : write last dirty data to old blkaddr - move_data_block - load old data from meta_inode page - f2fs_submit_page_write : write old data to new blkaddr

Because invalidate_mapping_pages() will skip invalidating page which has unclear status including locked, dirty, writeback and so on, so we need to use truncate_inode_pages_range() instead of invalidate_mapping_pages() to make sure meta_inode page will be dropped.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 6aa58d8ad20a3323f42274c25820a6f54192422d to before 0721a4f85d12a364002a9476c84b930fbc993f83Affected
  • 6aa58d8ad20a3323f42274c25820a6f54192422d to before c92f2927df860a60ba815d3ee610a944b92a8694Affected
  • 6aa58d8ad20a3323f42274c25820a6f54192422d to before 77bfdb89cc222fc7bfe198eda77bdc427d5ac189Affected
  • 6aa58d8ad20a3323f42274c25820a6f54192422d to before 04226d8e3c4028dc451e9d8777356ec0f7919253Affected
  • 6aa58d8ad20a3323f42274c25820a6f54192422d to before 9f0c4a46be1fe9b97dbe66d49204c1371e3ece65Affected
LinuxLinux
  • 4.19Affected
  • before 4.19Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.23 through 6.6.*Not affected
  • 6.7.11 through 6.7.*Not affected
  • 6.8.2 through 6.8.*Not affected
  • 6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.