CVE-2026-63816

f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

State: Published
Severity: 7.8 High
Published: Jul 19, 2026
Updated: Aug 17, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

- ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink - f2fs_gc - gc_data_segment - ra_data_block(cow_inode) - mapping = F2FS_I(inode)->atomic_inode->i_mapping : f2fs_is_cow_file(cow_inode) is true - f2fs_evict_inode(atomic_inode) - clear_inode_flag(fi->cow_inode, FI_COW_FILE) - F2FS_I(fi->cow_inode)->atomic_inode = NULL ... - truncate_inode_pages_final(atomic_inode) - f2fs_grab_cache_folio(mapping) : create folio in atomic_inode->mapping - clear_inode(atomic_inode) - BUG_ON(atomic_inode->i_data.nrpages)

We need to add a reference on fi->atomic_inode before using its mapping field during garbage collection, otherwise, it will cause UAF issue.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3db1de0e582c358dd013f3703cd55b5fe4076436 to before 7d3ae21783e5914c1761ac7d63f882d3d70800e9Affected 3db1de0e582c358dd013f3703cd55b5fe4076436 to before 56038756aae68312df00d4aa1d97e51ef3aca725Affected 3db1de0e582c358dd013f3703cd55b5fe4076436 to before a499f77c06050a28c897bdbd86cd2f0721ae0743Affected 3db1de0e582c358dd013f3703cd55b5fe4076436 to before a805fec35c201c59643ddcde713bce4051c8ee27Affected 3db1de0e582c358dd013f3703cd55b5fe4076436 to before e0288584baa5dc41df4a829a023c4c1b33fe53d7Affected 6db52f1944417c2601182a591a704e2f119c5215Affected 5.18.18 to before 5.19Affected
LinuxLinux	5.19Affected before 5.19Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.3 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

3db1de0e582c358dd013f3703cd55b5fe4076436 to before 7d3ae21783e5914c1761ac7d63f882d3d70800e9Affected
3db1de0e582c358dd013f3703cd55b5fe4076436 to before 56038756aae68312df00d4aa1d97e51ef3aca725Affected
3db1de0e582c358dd013f3703cd55b5fe4076436 to before a499f77c06050a28c897bdbd86cd2f0721ae0743Affected
3db1de0e582c358dd013f3703cd55b5fe4076436 to before a805fec35c201c59643ddcde713bce4051c8ee27Affected
3db1de0e582c358dd013f3703cd55b5fe4076436 to before e0288584baa5dc41df4a829a023c4c1b33fe53d7Affected
6db52f1944417c2601182a591a704e2f119c5215Affected
5.18.18 to before 5.19Affected

LinuxLinux

5.19Affected
before 5.19Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.3 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.