Linux Kernel f2fs CVE-2026-53017

f2fs must be the active filesystem on the affected storage volume - systems using ext4, XFS, btrfs, or any other filesystem are entirely unaffected. The race specifically requires a file that was created after the last successful checkpoint (i.e., IS_CHECKPOINTED has never been legitimately set for that inode), concurrent execution of fsync on that file and a kernel checkpoint operation, and a subsequent sudden power off or unclean shutdown to manifest data loss; without SPO, in-memory state may allow eventual recovery. Local access with at minimum standard user privileges is required (PR:L per CVSS). The race window is timing-dependent and more likely under high-I/O workloads on flash storage. The 'Information Disclosure' intelligence tag does not apply - confidentiality impact is confirmed as none (C:N) by the CVSS vector.

The provided CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H rates this as Medium (5.5), but the AC:L assignment warrants scrutiny: this is a race condition requiring specific concurrent timing between fsync and checkpoint operations, which conventionally maps to AC:H. The practical exploitation window is narrow - the newly created file must not have been included in any prior checkpoint, and a sudden power loss must occur immediately after the flawed fsync returns. EPSS at 0.16% (6th percentile) strongly supports this low-probability characterization. The CVE is absent from CISA KEV and no POC code has been identified. The 'Information Disclosure' tag in the intelligence data is inconsistent with the CVSS vector (C:N) and description (data loss, not data disclosure) - this tag should be treated as erroneous. Real-world priority is highest for Android devices, embedded Linux platforms, and flash-storage servers explicitly using f2fs; systems on ext4, XFS, or btrfs are entirely unaffected regardless of kernel version.

A local user on a Linux system using f2fs-formatted storage creates a new file, writes data, and calls fsync while the kernel concurrently executes a checkpoint operation. The race causes fsync to skip flushing the inode block based on prematurely set nat_entry flags; if the system then experiences a sudden power loss or kernel panic, the file and all its written data are permanently lost with no recovery path from the filesystem journal.