CVE-2026-23267

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23267
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes During SPO tests, when mounting F2FS, an -EINVAL error was returned from f2fs_recover_inode_page. The issue occurred under the following scenario Thread A Thread B f2fs_ioc_commit_atomic_write - f2fs_do_sync_file // atomic = true - f2fs_fsync_node_pages : last_folio = inode folio : schedule before folio_lock(last_folio) f2fs_write_checkpoint - block_operations// writeback last_folio - schedule before f2fs_flush_nat_entries : set_fsync_mark(last_folio, 1) : set_dentry_mark(last_folio, 1) : folio_mark_dirty(last_folio) - __write_node_folio(last_folio) : f2fs_down_read(&sbi->node_write)//block - f2fs_flush_nat_entries : {struct nat_entry}->flag |= BIT(IS_CHECKPOINTED) - unblock_operations : f2fs_up_write(&sbi->node_write) f2fs_write_checkpoint//return : f2fs_do_write_node_page() f2fs_ioc_commit_atomic_write//return SPO Thread A calls f2fs_need_dentry_mark(sbi, ino), and the last_folio has already been written once. However, the {struct nat_entry}->flag did not have the IS_CHECKPOINTED set, causing set_dentry_mark(last_folio, 1) and write last_folio again after Thread B finishes f2fs_write_checkpoint. After SPO and reboot, it was detected that {struct node_info}->blk_addr was not NULL_ADDR because Thread B successfully write the checkpoint. This issue only occurs in atomic write scenarios. For regular file fsync operations, the folio must be dirty. If block_operations->f2fs_sync_node_pages successfully submit the folio write, this path will not be executed. Otherwise, the f2fs_write_checkpoint will need to wait for the folio write submission to complete, as sbi->nr_pages[F2FS_DIRTY_NODES] > 0. Therefore, the situation where f2fs_need_dentry_mark checks that the {struct nat_entry}->flag /wo the IS_CHECKPOINTED flag, but the folio write has already been submitted, will not occur. Therefore, for atomic file fsync, sbi->node_write should be acquired through __write_node_folio to ensure that the IS_CHECKPOINTED flag correctly indicates that the checkpoint write has been completed.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/32bc3c9fe18881d50dd51fd5f26d19fe1190dc0d Patch
https://git.kernel.org/stable/c/75e19da068adf0dc5dd269dd157392434b9117d4 Patch
https://git.kernel.org/stable/c/7633a7387eb4d0259d6bea945e1d3469cd135bbc Patch
https://git.kernel.org/stable/c/962c167b0f262b9962207fbeaa531721d55ea00e Patch
https://git.kernel.org/stable/c/bd66b4c487d5091d2a65d6089e0de36f0c26a4c7 Patch
https://git.kernel.org/stable/c/ed81bc5885460905f9160e7b463e5708fd056324 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

29 May 2026, 18:41

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: f2fs: corrige el problema de inconsistencia del flag IS_CHECKPOINTED causado por escrituras concurrentes de commit atómico y checkpoint Durante las pruebas SPO, al montar F2FS, se devolvió un error -EINVAL desde f2fs_recover_inode_page. El problema ocurrió bajo el siguiente escenario Hilo A Hilo B f2fs_ioc_commit_atomic_write - f2fs_do_sync_file // atómico = true - f2fs_fsync_node_pages : last_folio = inode folio : schedule before folio_lock(last_folio) f2fs_write_checkpoint - block_operations// writeback last_folio - schedule before f2fs_flush_nat_entries : set_fsync_mark(last_folio, 1) : set_dentry_mark(last_folio, 1) : folio_mark_dirty(last_folio) - __write_node_folio(last_folio) : f2fs_down_read(&sbi->node_write)//bloquea - f2fs_flush_nat_entries : {struct nat_entry}->flag |= BIT(IS_CHECKPOINTED) - unblock_operations : f2fs_up_write(&sbi->node_write) f2fs_write_checkpoint//retorna : f2fs_do_write_node_page() f2fs_ioc_commit_atomic_write//retorna SPO El Hilo A llama a f2fs_need_dentry_mark(sbi, ino), y el last_folio ya ha sido escrito una vez. Sin embargo, el {struct nat_entry}->flag no tenía el IS_CHECKPOINTED establecido, causando que set_dentry_mark(last_folio, 1) y se escriba last_folio de nuevo después de que el Hilo B termine f2fs_write_checkpoint. Después de SPO y el reinicio, se detectó que {struct node_info}->blk_addr no era NULL_ADDR porque el Hilo B escribió exitosamente el checkpoint. Este problema solo ocurre en escenarios de escritura atómica. Para operaciones fsync de archivos regulares, el folio debe estar sucio. Si block_operations->f2fs_sync_node_pages envía exitosamente la escritura del folio, esta ruta no se ejecutará. De lo contrario, f2fs_write_checkpoint deberá esperar a que se complete el envío de la escritura del folio, ya que sbi->nr_pages[F2FS_DIRTY_NODES] > 0. Por lo tanto, la situación en la que f2fs_need_dentry_mark verifica que el {struct nat_entry}->flag sin el flag IS_CHECKPOINTED, pero la escritura del folio ya ha sido enviada, no ocurrirá. Por lo tanto, para fsync de archivos atómicos, sbi->node_write debe adquirirse a través de __write_node_folio para asegurar que el flag IS_CHECKPOINTED indique correctamente que la escritura del checkpoint ha sido completada.
References () https://git.kernel.org/stable/c/32bc3c9fe18881d50dd51fd5f26d19fe1190dc0d - () https://git.kernel.org/stable/c/32bc3c9fe18881d50dd51fd5f26d19fe1190dc0d - Patch
References () https://git.kernel.org/stable/c/75e19da068adf0dc5dd269dd157392434b9117d4 - () https://git.kernel.org/stable/c/75e19da068adf0dc5dd269dd157392434b9117d4 - Patch
References () https://git.kernel.org/stable/c/7633a7387eb4d0259d6bea945e1d3469cd135bbc - () https://git.kernel.org/stable/c/7633a7387eb4d0259d6bea945e1d3469cd135bbc - Patch
References () https://git.kernel.org/stable/c/962c167b0f262b9962207fbeaa531721d55ea00e - () https://git.kernel.org/stable/c/962c167b0f262b9962207fbeaa531721d55ea00e - Patch
References () https://git.kernel.org/stable/c/bd66b4c487d5091d2a65d6089e0de36f0c26a4c7 - () https://git.kernel.org/stable/c/bd66b4c487d5091d2a65d6089e0de36f0c26a4c7 - Patch
References () https://git.kernel.org/stable/c/ed81bc5885460905f9160e7b463e5708fd056324 - () https://git.kernel.org/stable/c/ed81bc5885460905f9160e7b463e5708fd056324 - Patch
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel

18 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-18 18:16

Updated : 2026-05-29 18:41

NVD link : CVE-2026-23267

Mitre link : CVE-2026-23267

CVE.ORG link : CVE-2026-23267

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo