CVE-2026-31715

f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()

State: Published
Severity: Not scored
Published: May 1, 2026
Updated: Jun 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()

The xfstests case "generic/107" and syzbot have both reported a NULL pointer dereference.

The concurrent scenario that triggers the panic is as follows:

F2FS_WB_CP_DATA write callback umount - f2fs_write_checkpoint - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA) - blk_mq_end_request - bio_endio - f2fs_write_end_io : dec_page_count(sbi, F2FS_WB_CP_DATA) : wake_up(&sbi->cp_wait) - kill_f2fs_super - kill_block_super - f2fs_put_super : iput(sbi->node_inode) : sbi->node_inode = NULL : f2fs_in_warm_node_list - is_node_folio // sbi->node_inode is NULL and panic

The root cause is that f2fs_put_super() calls iput(sbi->node_inode) and sets sbi->node_inode to NULL after sbi->nr_pages[F2FS_WB_CP_DATA] is decremented to zero. As a result, f2fs_in_warm_node_list() may dereference a NULL node_inode when checking whether a folio belongs to the node inode, leading to a panic.

This patch fixes the issue by calling f2fs_in_warm_node_list() before decrementing sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the use-after-free condition.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 7dbdab4430e4654db9aacef12b9b3b8b29ca25cbAffected 50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before ffb94770dbdfb5411be5d9f44a960b010ec890adAffected 50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 0d40b26377f891e6dcb6efaf8ef9374c99be1b1dAffected 50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 1171f329cf1c175321251ac40fd126150d7ad1e8Affected 50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 7be222de96c0f9eee6e65eeb017ef855ee185cfaAffected 50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 963d2e24d9d92a31e6773b0f642214f10013ebf7Affected 50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 188bb65f247a7a7c62f287c9a263aee3cad96fa5Affected 50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.86 through 6.12.Not affected 6.18.25 through 6.18.Not affected 7.0.2 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 7dbdab4430e4654db9aacef12b9b3b8b29ca25cbAffected
50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before ffb94770dbdfb5411be5d9f44a960b010ec890adAffected
50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 0d40b26377f891e6dcb6efaf8ef9374c99be1b1dAffected
50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 1171f329cf1c175321251ac40fd126150d7ad1e8Affected
50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 7be222de96c0f9eee6e65eeb017ef855ee185cfaAffected
50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 963d2e24d9d92a31e6773b0f642214f10013ebf7Affected
50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 188bb65f247a7a7c62f287c9a263aee3cad96fa5Affected
50fa53eccf9f911a5b435248a2b0bd484fd82e5e to before 2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.86 through 6.12.*Not affected
6.18.25 through 6.18.*Not affected
7.0.2 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.