CVE-2026-63812

f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()

State: Published
Severity: 7.8 High
Published: Jul 19, 2026
Updated: Oct 30, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()

When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388:

F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix

In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache.

This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	42dd1c91f993431d0b399502479d00e6ad1bca71 to before 7e4d8f98be63f98856a5176b9188dada6e7ba9eeAffected ab1eaf9d5c99042f5b0243bf67a06283a4c0757f to before 58a5deb220bcac4c73bf58954c0845644c997487Affected b0e4395870eb3441ddc959f6710b5f6ca61aff26 to before 20190e498057997532c7f186d081011f18e0a462Affected ed78aeebef05212ef7dca93bd931e4eff67c113f to before edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7Affected ed78aeebef05212ef7dca93bd931e4eff67c113f to before 1f70ddb28a3c71df124da5fa4040c808116d6bb9Affected b00e6950da9c0e4986f6e93c875d2b9184bdb220Affected 0559a0e962aacbb47519e26ee663be04b72dcb92Affected 6.6.140 to before 6.6.144Affected 6.12.88 to before 6.12.95Affected 6.18.30 to before 6.18.38Affected 6.1.191 to before 6.2Affected 7.0.7 to before 7.1Affected
LinuxLinux	7.1Affected before 7.1Not affected 6.6.144 through 6.6.Not affected 6.12.95 through 6.12.Not affected 6.18.38 through 6.18.Not affected 7.1.3 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

42dd1c91f993431d0b399502479d00e6ad1bca71 to before 7e4d8f98be63f98856a5176b9188dada6e7ba9eeAffected
ab1eaf9d5c99042f5b0243bf67a06283a4c0757f to before 58a5deb220bcac4c73bf58954c0845644c997487Affected
b0e4395870eb3441ddc959f6710b5f6ca61aff26 to before 20190e498057997532c7f186d081011f18e0a462Affected
ed78aeebef05212ef7dca93bd931e4eff67c113f to before edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7Affected
ed78aeebef05212ef7dca93bd931e4eff67c113f to before 1f70ddb28a3c71df124da5fa4040c808116d6bb9Affected
b00e6950da9c0e4986f6e93c875d2b9184bdb220Affected
0559a0e962aacbb47519e26ee663be04b72dcb92Affected
6.6.140 to before 6.6.144Affected
6.12.88 to before 6.12.95Affected
6.18.30 to before 6.18.38Affected
6.1.191 to before 6.2Affected
7.0.7 to before 7.1Affected

LinuxLinux

7.1Affected
before 7.1Not affected
6.6.144 through 6.6.*Not affected
6.12.95 through 6.12.*Not affected
6.18.38 through 6.18.*Not affected
7.1.3 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.