Skip to main content

Linux Kernel CVE-2026-53368

| EUVDEUVD-2026-45438 HIGH
2026-07-19 Linux GHSA-7cj6-gq26-374h
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
6.3 MEDIUM

Local low-privilege file operations only (AV:L/PR:L); a timing-dependent race also needing sudden power-off raises complexity to AC:H; impact is metadata integrity/availability, no confidentiality (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:59 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.1 (HIGH)
Patch available
Jul 19, 2026 - 11:02 EUVD
CVE Published
Jul 19, 2026 - 09:10 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 09:10 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage

f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The scenario is as follows:

create & write & fsync 'file A' write checkpoint

  • f2fs_do_sync_file // inline inode
  • f2fs_write_inode // inode folio is dirty
  • f2fs_write_checkpoint
  • f2fs_flush_merged_writes
  • f2fs_sync_node_pages
  • f2fs_fsync_node_pages // no dirty node
  • f2fs_need_inode_block_update // return true
  • f2fs_fsync_node_pages // inode dirtied
  • f2fs_need_dentry_mark //return true
  • f2fs_flush_nat_entries
  • f2fs_write_checkpoint end
  • __write_node_folio // inode with DENT_BIT_SHIFT set

SPO, "fsck --dry-run" find inode has already checkpointed but still with DENT_BIT_SHIFT set

The state observed by f2fs_need_dentry_mark() can differ from the state observed in __write_node_folio() after acquiring sbi->node_write. The root cause is that the semantics of IS_CHECKPOINTED and HAS_FSYNCED_INODE are only guaranteed after the checkpoint write has fully completed.

This patch moves set_dentry_mark() into __write_node_folio() and protects it with the sbi->node_write lock.

AnalysisAI

Filesystem metadata corruption in the Linux kernel's F2FS (Flash-Friendly File System) driver arises from a race between f2fs_need_dentry_mark() reading nat_entry flags and the concurrent checkpoint path, so a node folio can be written with the DENT_BIT_SHIFT dentry-mark set even though the inode was already checkpointed. After a sudden power-off, fsck detects this inconsistent inode state. This is a local, low-privilege integrity/availability issue with no public exploit identified at time of analysis; EPSS is low at 0.17% and it is not listed in CISA KEV.

Technical ContextAI

F2FS is a log-structured filesystem optimized for flash/SSD storage that is upstreamed in the mainline Linux kernel and used in Android and some Linux deployments. The bug lives in the interaction between fsync handling (f2fs_do_sync_file → f2fs_fsync_node_pages → f2fs_need_dentry_mark) and the checkpoint writeback path (f2fs_write_checkpoint → f2fs_flush_nat_entries). The NAT (Node Address Table) entry flags IS_CHECKPOINTED and HAS_FSYNCED_INODE are only semantically valid once the checkpoint write has fully completed, but f2fs_need_dentry_mark() reads them without holding the sbi->node_write lock, so the state it observes can differ from the state seen inside __write_node_folio() after that lock is acquired. The root cause is a classic concurrency defect (CWE-362, race condition / improper synchronization); the CWE field is N/A in the source data. The fix moves set_dentry_mark() into __write_node_folio() under sbi->node_write protection.

RemediationAI

Vendor-released patch: update to Linux kernel 7.1, or the stable backports 7.0.7 or 6.18.30, which move set_dentry_mark() into __write_node_folio() under the sbi->node_write lock (fix commits https://git.kernel.org/stable/c/bedb710b63ae1bd617e65d0a8cf6cea1200b3753, https://git.kernel.org/stable/c/b28a83ea4934215b5de906c3ee4fbfbc651573e0, and https://git.kernel.org/stable/c/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc). Apply the distribution kernel update containing these commits and reboot. Where immediate patching is not possible, compensating controls are limited because the trigger is normal fsync/checkpoint activity: restrict local account access on affected hosts to reduce who can drive the workload, and if an inconsistency is suspected after an unclean shutdown run 'fsck.f2fs' to detect and repair the DENT_BIT_SHIFT state (trade-off: fsck requires the filesystem be unmounted or checked at boot, causing downtime). Ensuring reliable power (UPS) reduces the sudden-power-off condition needed to surface the corruption but does not remove the underlying race.

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid

CVE-2026-50751 CRITICAL POC
9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker

CVE-2026-85103 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu

CVE-2026-85102 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V

CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

CVE-2026-24747 HIGH POC
8.8 Jan 27

PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]

CVE-2022-41604 HIGH POC
8.8 Sep 27

Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever

CVE-2026-58659 HIGH POC
8.4 Jul 15

Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53368 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy