Skip to main content

Linux Kernel EUVDEUVD-2026-32802

| CVE-2026-46175 HIGH
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-vwpg-8m6q-566g
Information Disclosure Linux
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local F2FS access
  2. Delivery
    Invoke f2fs_io gc_range to force FGGC
  3. Exploit
    Migrated node retains dentry/fsync marks
  4. Execution
    Trigger sudden power-off
  5. Persist
    Boot triggers fsck misinterpretation
  6. Impact
    Filesystem inconsistency or data loss

Vulnerability Assessment

Exploitation Conditions

Requires local access to a system using the F2FS filesystem with the f2fs_io ioctl interface accessible (typically CAP_SYS_ADMIN or filesystem-owner privileges), the ability to invoke gc_range to trigger Foreground Garbage Collection without a subsequent checkpoint write, and a sudden power-off event before the next checkpoint. Exploitation is limited to systems running F2FS (predominantly Android, ChromeOS, and embedded Linux deployments), is not triggerable remotely, requires local low-privileged access per PR:L in the CVSS vector, and depends on a power-loss or crash event to manifest as fsck inconsistency.
Impact

The CVSS 7.1 score (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects local low-privilege attack vector with high integrity and availability impact but no confidentiality loss - consistent with a filesystem-consistency bug rather than a memory-safety flaw. EPSS at 0.02% (4th percentile) and absence from CISA KEV indicate this is not under active exploitation, and no public exploit identified at time of analysis. The realistic threat is much narrower than the CVSS suggests: triggering the condition requires F2FS mount, FGGC activation via a privileged interface (f2fs_io gc_range), and a sudden power-off - making this primarily a reliability/data-integrity issue for F2FS users (notably Android devices and embedded Linux) rather than a remotely weaponizable vulnerability. The 'Information Disclosure' tag from the source appears mismatched with the actual impact (C:N in the vector confirms no confidentiality loss); the real impact is filesystem inconsistency.
Exploit ScenarioDerived

A local user with permissions to invoke f2fs_io on an F2FS-mounted volume issues a gc_range call to force FGGC of node blocks without writing a checkpoint, then induces a sudden power-off (or the system crashes). On reboot, fsck flags inodes as having stale fsync data despite being properly checkpointed, leading to filesystem repair actions that may corrupt or roll back legitimate metadata.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Filesystem inconsistency in the Linux kernel's F2FS implementation allows local authenticated users to trigger fsck misinterpretation of node block migration as fsync-written data, resulting in filesystem integrity issues following a sudden power-off (SPO). Affecting Linux kernel versions through 7.0.7 and 7.1-rc1 (with backports to 6.18.30), the flaw stems from Foreground Garbage Collection (FGGC) failing to clear dentry and fsync marks during node block migration. No public exploit identified at time of analysis, and EPSS is very low at 0.02% (4th percentile).

RemediationAI

Upstream fix available; apply the patched stable kernel versions 6.18.30, 7.0.7, or 7.1-rc1 once distribution packages are released, sourcing the fix from the kernel.org commits at https://git.kernel.org/stable/c/8be551f538dc5b64183e27bd45a7a0795263f760, https://git.kernel.org/stable/c/e7c6d30169b03307d27c4479563df79c08f3a746, and https://git.kernel.org/stable/c/c3e238bd1f56993f205ef83889d406dfeaf717a8. Until patches are deployed, restrict access to the f2fs_io ioctl interface (which requires CAP_SYS_ADMIN or filesystem ownership) and avoid invoking manual FGGC operations such as gc_range on production filesystems - the side effect is loss of administrative GC tuning. As a deeper mitigation, consider mounting non-critical workloads on ext4 or XFS instead of F2FS where feasible, accepting the trade-off of reduced flash-storage efficiency; ensure systems using F2FS have reliable power delivery or UPS protection to reduce the window in which SPO can trigger the fsck inconsistency.

Affected VersionsENISA

Linux da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f <8be551f538dc5b64183e27bd45a7a0795263f760
Linux da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f <e7c6d30169b03307d27c4479563df79c08f3a746
Linux patch: 7.0.7
Linux patch: 0
Linux patch: 7.1-rc1
Linux 4.7
Linux patch: 6.18.30
Linux da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f <c3e238bd1f56993f205ef83889d406dfeaf717a8

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the Flash-Friendly File System (F2FS), a log-structured filesystem in the Linux kernel optimized for NAND-based storage like SSDs and eMMC. F2FS uses Garbage Collection (GC) in two modes: Background GC (BGGC), which routes node block migrations through f2fs_sync_node_pages() and correctly clears dentry/fsync marks, and Foreground GC (FGGC), which historically bypassed this cleanup path. When FGGC migrates a node block, the residual DENT_BIT_SHIFT and fsync marks survive, and after a sudden power-off, fsck --dry-run misinterprets a checkpointed inode as having outstanding fsync-written data. The patch refactors the mark management into __write_node_folio() to centralize the set/clear logic across both GC paths.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SUSE HIGH

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
7.1 (HIGH)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)
CVE Published
May 28, 2026 - 10:16 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix fsck inconsistency caused by FGGC of node block

During FGGC node block migration, fsck may incorrectly treat the migrated node block as fsync-written data.

The reproduction scenario: root@vm:/mnt/f2fs

seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync

root@vm:/mnt/f2fs

rm -f 1

root@vm:/mnt/f2fs

sync

root@vm:/mnt/f2fs

f2fs_io gc_range // move data block in sync mode and not write CP

SPO, "fsck --dry-run" find inode has already checkpointed but still with DENT_BIT_SHIFT set

The root cause is that GC does not clear the dentry mark and fsync mark during node block migration, leading fsck to misinterpret them as user-issued fsync writes.

In BGGC mode, node block migration is handled by f2fs_sync_node_pages(), which guarantees the dentry and fsync marks are cleared before writing.

This patch move the set/clear of the fsync|dentry marks into __write_node_folio to make the logic clearer, and ensures the fsync|dentry mark is cleared in FGGC.

Executive ViewAI

Why It Matters

A Linux kernel vulnerability (CVE-2026-46175) in F2FS filesystem handling may cause data integrity failures after unexpected system shutdown on affected deployments; no public exploit identified at time of analysis. The risk is limited to organizations using F2FS requiring local authenticated system access, but filesystem corruption could necessitate recovery operations and service disruption. Organizations should audit their Linux infrastructure for F2FS usage and prioritize patching to eliminate this failure scenario.

Business Impact: High
Compensating Controls

Patch available per vendor advisory. Interim mitigations: ensure power redundancy (UPS) on F2FS systems to prevent unexpected shutdown; schedule regular filesystem verification during maintenance windows; maintain validated backup procedures for all F2FS storage volumes.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46175 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/366646 REF https://git.kernel.org/stable/c/3b7a0bbb3444addddb139f42a74ab4492052fa27 REF https://git.kernel.org/stable/c/8ac93964658d0649337dcb3f6e38d77f8cdd86f3 REF https://git.kernel.org/stable/c/8be551f538dc5b64183e27bd45a7a0795263f760 REF https://git.kernel.org/stable/c/c3e238bd1f56993f205ef83889d406dfeaf717a8 REF https://git.kernel.org/stable/c/d1820a5814eadb8e63ab6c7c8d04e28ce49836be REF https://git.kernel.org/stable/c/e7c6d30169b03307d27c4479563df79c08f3a746

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy