CVE-2026-46175

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46175", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.103Z", "datePublished": "2026-05-28T09:36:29.522Z", "dateUpdated": "2026-10-30T12:26:03.732Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:26:03.732Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix fsck inconsistency caused by FGGC of node block\n\nDuring FGGC node block migration, fsck may incorrectly treat the\nmigrated node block as fsync-written data.\n\nThe reproduction scenario:\nroot@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync\nroot@vm:/mnt/f2fs# rm -f 1\nroot@vm:/mnt/f2fs# sync\nroot@vm:/mnt/f2fs# f2fs_io gc_range // move data block in sync mode and not write CP\n SPO, \"fsck --dry-run\" find inode has already checkpointed but still\n with DENT_BIT_SHIFT set\n\nThe root cause is that GC does not clear the dentry mark and fsync mark\nduring node block migration, leading fsck to misinterpret them as\nuser-issued fsync writes.\n\nIn BGGC mode, node block migration is handled by f2fs_sync_node_pages(),\nwhich guarantees the dentry and fsync marks are cleared before writing.\n\nThis patch move the set/clear of the fsync|dentry marks into\n__write_node_folio to make the logic clearer, and ensures the\nfsync|dentry mark is cleared in FGGC."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - f2fs is a local block-device filesystem (default on Android/embedded); the vulnerable FGGC path is reached only by a local actor writing to a mounted f2fs volume, not over any network.\nAC:L - The attacker fully sets up the trigger (write+fsync an inline inode, delete it, exhaust free space to force FGGC of its node block); the corrupt on-disk state then persists until the next checkpoint, and routine power cycles/reboots on the target devices reliably invoke the faulty recovery.\nPR:L - While the GC ioctls require CAP_SYS_ADMIN, automatic foreground GC (f2fs_balance_fs \u2192 f2fs_gc promoting to FG_GC on low free space) runs the exact vulnerable path for any unprivileged user with write access to the filesystem.\nUI:N - Roll-forward recovery runs automatically during the next mount after a crash; no victim action is needed beyond the normal, automatic crash-and-remount cycle.\nS:U - The corruption is confined to the f2fs on-disk structures and the kernel managing them; it does not cross into a different security authority.\nC:N - The bug corrupts filesystem-consistency metadata but provides no read primitive over kernel memory or otherwise-inaccessible data, so there is no information disclosure.\nI:H - The migrated node block is misinterpreted as fsynced data, causing incorrect roll-forward recovery that resurrects deleted/stale inode metadata and leaves the on-disk filesystem inconsistent (fsck-detected) \u2014 a serious integrity compromise of stored data.\nA:H - A bad recovery can return an error, aborting the mount and rendering the filesystem/data unavailable until offline fsck (e.g. /data mount failure), and with CONFIG_F2FS_CHECK_FS the recovery error path hits BUG_ON(), crashing the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/node.c"], "versions": [{"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "lessThan": "3b7a0bbb3444addddb139f42a74ab4492052fa27", "status": "affected", "versionType": "git"}, {"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "lessThan": "d1820a5814eadb8e63ab6c7c8d04e28ce49836be", "status": "affected", "versionType": "git"}, {"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "lessThan": "8ac93964658d0649337dcb3f6e38d77f8cdd86f3", "status": "affected", "versionType": "git"}, {"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "lessThan": "8be551f538dc5b64183e27bd45a7a0795263f760", "status": "affected", "versionType": "git"}, {"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "lessThan": "e7c6d30169b03307d27c4479563df79c08f3a746", "status": "affected", "versionType": "git"}, {"version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "lessThan": "c3e238bd1f56993f205ef83889d406dfeaf717a8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/node.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3b7a0bbb3444addddb139f42a74ab4492052fa27"}, {"url": "https://git.kernel.org/stable/c/d1820a5814eadb8e63ab6c7c8d04e28ce49836be"}, {"url": "https://git.kernel.org/stable/c/8ac93964658d0649337dcb3f6e38d77f8cdd86f3"}, {"url": "https://git.kernel.org/stable/c/8be551f538dc5b64183e27bd45a7a0795263f760"}, {"url": "https://git.kernel.org/stable/c/e7c6d30169b03307d27c4479563df79c08f3a746"}, {"url": "https://git.kernel.org/stable/c/c3e238bd1f56993f205ef83889d406dfeaf717a8"}], "title": "f2fs: fix fsck inconsistency caused by FGGC of node block", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/f2fs/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3b7a0bbb3444addddb139f42a74ab4492052fa27", "status": "affected", "version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "versionType": "git"}, {"lessThan": "d1820a5814eadb8e63ab6c7c8d04e28ce49836be", "status": "affected", "version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "versionType": "git"}, {"lessThan": "8ac93964658d0649337dcb3f6e38d77f8cdd86f3", "status": "affected", "version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "versionType": "git"}, {"lessThan": "8be551f538dc5b64183e27bd45a7a0795263f760", "status": "affected", "version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "versionType": "git"}, {"lessThan": "e7c6d30169b03307d27c4479563df79c08f3a746", "status": "affected", "version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "versionType": "git"}, {"lessThan": "c3e238bd1f56993f205ef83889d406dfeaf717a8", "status": "affected", "version": "da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/f2fs/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1C461EB-D960-4EDF-ABA3-671CF601DAE7", "versionEndExcluding": "6.18.30", "versionStartIncluding": "4.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix fsck inconsistency caused by FGGC of node block\n\nDuring FGGC node block migration, fsck may incorrectly treat the\nmigrated node block as fsync-written data.\n\nThe reproduction scenario:\nroot@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync\nroot@vm:/mnt/f2fs# rm -f 1\nroot@vm:/mnt/f2fs# sync\nroot@vm:/mnt/f2fs# f2fs_io gc_range // move data block in sync mode and not write CP\n SPO, \"fsck --dry-run\" find inode has already checkpointed but still\n with DENT_BIT_SHIFT set\n\nThe root cause is that GC does not clear the dentry mark and fsync mark\nduring node block migration, leading fsck to misinterpret them as\nuser-issued fsync writes.\n\nIn BGGC mode, node block migration is handled by f2fs_sync_node_pages(),\nwhich guarantees the dentry and fsync marks are cleared before writing.\n\nThis patch move the set/clear of the fsync|dentry marks into\n__write_node_folio to make the logic clearer, and ensures the\nfsync|dentry mark is cleared in FGGC."}], "id": "CVE-2026-46175", "lastModified": "2026-10-30T13:18:56.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-28T10:16:33.130", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b7a0bbb3444addddb139f42a74ab4492052fa27"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8ac93964658d0649337dcb3f6e38d77f8cdd86f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8be551f538dc5b64183e27bd45a7a0795263f760"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c3e238bd1f56993f205ef83889d406dfeaf717a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d1820a5814eadb8e63ab6c7c8d04e28ce49836be"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e7c6d30169b03307d27c4479563df79c08f3a746"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: f2fs: fix fsck inconsistency caused by FGGC of node block", "id": "2482583", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482583"}, "csaw": false, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel's f2fs filesystem. During Foreground Garbage Collection (FGGC) of node blocks, the system fails to properly clear internal metadata marks. This can lead to filesystem inconsistencies, where the `fsck` utility may misinterpret the state of migrated data. A local user could potentially trigger this issue, resulting in incorrect filesystem reporting or data integrity problems."], "name": "CVE-2026-46175", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46175\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46175\nhttps://lore.kernel.org/linux-cve-announce/2026052828-CVE-2026-46175-8fc4@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f,8be551f538dc5b64183e27bd45a7a0795263f760)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f,e7c6d30169b03307d27c4479563df79c08f3a746)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f,c3e238bd1f56993f205ef83889d406dfeaf717a8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.30,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.7,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-28T12:15:21.823352+00:00", "updated": "2026-06-10T22:45:27.820049+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}