CVE-2026-53303

f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()

State: Published
Severity: Not scored
Published: Jun 26, 2026
Updated: Jun 26, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()

In f2fs_sbi_show(), the extension_list, extension_count and hot_ext_count are read without holding sbi->sb_lock. If a concurrent sysfs store modifies the extension list via f2fs_update_extension_list(), the show path may read inconsistent count and array contents, potentially leading to out-of-bounds access or displaying stale data.

Fix this by holding sb_lock around the entire extension list read and format operation.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b6a06cbbb5f7fd03589cff9178314af04c568826 to before d3ff0c121bbaef026df6248ab7ef6f0b068b0647Affected b6a06cbbb5f7fd03589cff9178314af04c568826 to before cea15f66b7b68b2c50943a6660e0692c6635e4ebAffected b6a06cbbb5f7fd03589cff9178314af04c568826 to before 4b3a1bf4c2ffd4c9595d900ead78c9035894a025Affected b6a06cbbb5f7fd03589cff9178314af04c568826 to before d0e877810baf613b018fd9747440b9d4d9db1428Affected b6a06cbbb5f7fd03589cff9178314af04c568826 to before ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92eAffected b6a06cbbb5f7fd03589cff9178314af04c568826 to before 5909bedbed38c558bee7cb6758ceedf9bc3a9194Affected
LinuxLinux	4.17Affected before 4.17Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

b6a06cbbb5f7fd03589cff9178314af04c568826 to before d3ff0c121bbaef026df6248ab7ef6f0b068b0647Affected
b6a06cbbb5f7fd03589cff9178314af04c568826 to before cea15f66b7b68b2c50943a6660e0692c6635e4ebAffected
b6a06cbbb5f7fd03589cff9178314af04c568826 to before 4b3a1bf4c2ffd4c9595d900ead78c9035894a025Affected
b6a06cbbb5f7fd03589cff9178314af04c568826 to before d0e877810baf613b018fd9747440b9d4d9db1428Affected
b6a06cbbb5f7fd03589cff9178314af04c568826 to before ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92eAffected
b6a06cbbb5f7fd03589cff9178314af04c568826 to before 5909bedbed38c558bee7cb6758ceedf9bc3a9194Affected

LinuxLinux

4.17Affected
before 4.17Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.