Skip to main content

Linux Kernel f2fs CVE-2026-53017

| EUVDEUVD-2026-38885 MEDIUM
2026-06-24 Linux GHSA-f2m7-5m7m-7g2c
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Race condition requires precise concurrent timing between fsync and checkpoint (AC:H); local f2fs user access (PR:L); impact is permanent data loss mapped to availability (A:H), no confidentiality or unauthorized modification.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 15, 2026 - 16:17 vuln.today
CVSS changed
Jul 15, 2026 - 14:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix data loss caused by incorrect use of nat_entry flag

Data loss can occur when fsync is performed on a newly created file (before any checkpoint has been written) concurrently with a checkpoint operation. The scenario is as follows:

create & write & fsync 'file A' write checkpoint

  • f2fs_do_sync_file // inline inode
  • f2fs_write_inode // inode folio is dirty
  • f2fs_write_checkpoint
  • f2fs_flush_merged_writes
  • f2fs_sync_node_pages
  • f2fs_flush_nat_entries
  • f2fs_fsync_node_pages // no dirty node
  • f2fs_need_inode_block_update // return false

SPO and lost 'file A'

f2fs_flush_nat_entries() sets the IS_CHECKPOINTED and HAS_LAST_FSYNC flags for the nat_entry, but this does not mean that the checkpoint has actually completed successfully. However, f2fs_need_inode_block_update() checks these flags and incorrectly assumes that the checkpoint has finished.

The root cause is that the semantics of IS_CHECKPOINTED and HAS_LAST_FSYNC are only guaranteed after the checkpoint write fully completes.

This patch modifies f2fs_need_inode_block_update() to acquire the sbi->node_write lock before reading the nat_entry flags, ensuring that once IS_CHECKPOINTED and HAS_LAST_FSYNC are observed to be set, the checkpoint operation has already completed.

AnalysisAI

Data loss in the Linux kernel's f2fs (Flash-Friendly File System) driver exposes files created and synced before any checkpoint has been written to permanent loss on sudden power off. The race condition between fsync on newly created files and concurrent checkpoint operations causes f2fs_need_inode_block_update() to misread prematurely set nat_entry flags (IS_CHECKPOINTED and HAS_LAST_FSYNC), leading fsync to skip the inode block flush it actually requires. No public exploit identified at time of analysis; the EPSS score of 0.16% at the 6th percentile reflects the narrow triggering conditions and local-only attack surface.

Technical ContextAI

f2fs (Flash-Friendly File System) is a Linux kernel filesystem optimized for NAND flash storage. It uses a checkpoint mechanism to guarantee filesystem consistency: NAT (Node Address Table) entries track inode locations, and their flags IS_CHECKPOINTED and HAS_LAST_FSYNC are supposed to signal that checkpoint I/O has fully completed. The vulnerability is in f2fs_flush_nat_entries(), which sets these flags as part of the checkpoint flush sequence but before the checkpoint write I/O actually finishes. f2fs_need_inode_block_update() then reads these flags without holding the sbi->node_write lock, creating a TOCTOU (Time-of-Check to Time-of-Use) race: a concurrent fsync observes the flags as set and skips the necessary inode block update. The fix synchronizes flag reads by acquiring sbi->node_write before reading nat_entry state, ensuring observed flag values are backed by completed I/O. No CWE is assigned in the input, but CWE-667 (Improper Locking) or CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) are the applicable root cause classes. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the full Linux kernel product line.

RemediationAI

Upgrade to Linux kernel 7.1 or 7.0.10, which contain the upstream fix per EUVD affected version data; the authoritative fix commits are at https://git.kernel.org/stable/c/238e14eb7226f883b72caccd2d37bf5707df066b and https://git.kernel.org/stable/c/20cedb4d9f6b230d0ee469690b8f868f06a07c29. For systems that cannot immediately patch, the most reliable compensating control is to migrate critical data volumes from f2fs to ext4 or XFS, which are unaffected by this race condition; note that this requires unmounting and reformatting, causing service disruption. If filesystem migration is not feasible, reducing concurrent I/O (e.g., serializing fsync and checkpoint-heavy operations through application-level locking) lowers but does not eliminate race probability, at the cost of throughput. Disabling f2fs module loading (modprobe -r f2fs) is the strongest software-only mitigation if the filesystem type is not required on the system.

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid

CVE-2026-50751 CRITICAL POC
9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker

CVE-2026-85103 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu

CVE-2026-85102 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V

CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

CVE-2026-24747 HIGH POC
8.8 Jan 27

PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]

CVE-2022-41604 HIGH POC
8.8 Sep 27

Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever

CVE-2026-58659 HIGH POC
8.4 Jul 15

Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53017 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy