{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63812","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.013Z","datePublished":"2026-07-19T12:02:13.606Z","dateUpdated":"2026-08-17T04:51:19.062Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T04:51:19.062Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()\n\nWhen __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does\nnot reset the length of the largest extent to 0 and update the inode\nfolio. Since modifications to the extent tree are disallowed afterward,\nthe cached largest extent may become stale. This can trigger the\nfollowing error in xfstests generic/388:\n\nF2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix\n\nIn the f2fs_drop_inode path, __destroy_extent_node() does not need to\nguarantee that et->node_cnt is 0, because concurrency with writeback\nis expected in this path, and writeback may update the extent cache.\n\nThis patch reverts commit ed78aeebef05 (\"f2fs: fix node_cnt race between\nextent node destroy and writeback\"), and remove the unnecessary zero\ncheck of et->node_cnt."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local VFS filesystem activity (write, unlink, concurrent writeback) on an F2FS mount, most severely on Android/embedded userdata partitions where F2FS is the default local filesystem.\nAC:L - An attacker can reliably orchestrate the inode-eviction/writeback race by unlinking files while writeback is in progress on the same inode, controlling both sides of the concurrency window.\nPR:L - Triggering the race requires only unprivileged write access to files on a mounted F2FS filesystem (e.g., creating, writing, and unlinking files in one's own directory on Android /data), not real root or CAP_SYS_ADMIN.\nUI:N - Exploitation requires no action from a separate victim; the attacker drives the file I/O and unlink operations that provoke the stale extent-cache state.\nS:U - Impact is confined to kernel/filesystem integrity on the affected host; there is no cross-security-authority boundary such as VM escape or container-to-host breakout.\nC:H - Stale largest-extent metadata persisted to the on-disk inode can cause subsequent reads (after inode reload or inode-number reuse) to map logical file offsets to wrong physical blocks, disclosing data from other files or freed blocks.\nI:H - Incorrect on-disk extent metadata corrupts the inode-to-block mapping and can cause wrong data blocks to be associated with a file, constituting exploitable filesystem metadata corruption with integrity impact beyond a simple crash.\nA:H - The stale cache triggers sanity_check_extent_cache failures (as seen in xfstests generic/388), f2fs_handle_error(ERROR_CORRUPTED_INODE), and potential kernel BUG_ON via f2fs_bug_on when CONFIG_F2FS_CHECK_FS is enabled, all causing denial of filesystem or kernel service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/extent_cache.c"],"versions":[{"version":"42dd1c91f993431d0b399502479d00e6ad1bca71","lessThan":"7e4d8f98be63f98856a5176b9188dada6e7ba9ee","status":"affected","versionType":"git"},{"version":"ab1eaf9d5c99042f5b0243bf67a06283a4c0757f","lessThan":"58a5deb220bcac4c73bf58954c0845644c997487","status":"affected","versionType":"git"},{"version":"b0e4395870eb3441ddc959f6710b5f6ca61aff26","lessThan":"20190e498057997532c7f186d081011f18e0a462","status":"affected","versionType":"git"},{"version":"ed78aeebef05212ef7dca93bd931e4eff67c113f","lessThan":"edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7","status":"affected","versionType":"git"},{"version":"ed78aeebef05212ef7dca93bd931e4eff67c113f","lessThan":"1f70ddb28a3c71df124da5fa4040c808116d6bb9","status":"affected","versionType":"git"},{"version":"0559a0e962aacbb47519e26ee663be04b72dcb92","status":"affected","versionType":"git"},{"version":"6.6.140","lessThan":"6.6.144","status":"affected","versionType":"semver"},{"version":"6.12.88","lessThan":"6.12.95","status":"affected","versionType":"semver"},{"version":"6.18.30","lessThan":"6.18.38","status":"affected","versionType":"semver"},{"version":"7.0.7","lessThan":"7.1","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/extent_cache.c"],"versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","status":"unaffected","versionType":"semver"},{"version":"6.6.144","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.38","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.3","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.140","versionEndExcluding":"6.6.144"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.88","versionEndExcluding":"6.12.95"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.30","versionEndExcluding":"6.18.38"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.7"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/7e4d8f98be63f98856a5176b9188dada6e7ba9ee"},{"url":"https://git.kernel.org/stable/c/58a5deb220bcac4c73bf58954c0845644c997487"},{"url":"https://git.kernel.org/stable/c/20190e498057997532c7f186d081011f18e0a462"},{"url":"https://git.kernel.org/stable/c/edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7"},{"url":"https://git.kernel.org/stable/c/1f70ddb28a3c71df124da5fa4040c808116d6bb9"}],"title":"f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()","x_generator":{"engine":"bippy-1.2.0"}}}}