CVE-2026-46194
kernel: f2fs: fix node_cnt race between extent node destroy and writeback
Published May 28, 2026
CVSS n/a
EPSS n/a
KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 Ubuntu USN |
USN-8566-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8567-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8568-1 | Linux kernel (OEM) vulnerabilities |
| Ubuntu USN |
USN-8569-1 | Linux kernel (HWE) vulnerabilities |
| Ubuntu USN |
USN-8574-1 | Linux kernel (GCP FIPS) vulnerabilities |
| Ubuntu USN |
USN-8593-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8574-2 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8595-1 | Linux kernel (Oracle) vulnerabilities |
| Ubuntu USN |
USN-8596-1 | Linux kernel (NVIDIA) vulnerabilities |
| Ubuntu USN |
USN-8595-2 | Linux kernel (AWS) vulnerabilities |
| Ubuntu USN |
USN-8603-1 | Linux kernel (Azure) vulnerabilities |
| Ubuntu USN |
USN-8606-1 | Linux kernel (Azure) vulnerabilities |
| Ubuntu USN |
USN-8607-1 | Linux kernel (Azure CVM) vulnerabilities |
| Ubuntu USN |
USN-8608-1 | Linux kernel (Azure FIPS) vulnerabilities |
| Ubuntu USN |
USN-8609-1 | Linux kernel (Azure CVM) vulnerabilities |
| Ubuntu USN |
USN-8574-3 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8595-3 | Linux kernel (AWS) vulnerabilities |
| Ubuntu USN |
USN-8618-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8619-1 | Linux kernel (HWE) vulnerabilities |
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
History
Aug 11, 2026 2:30 AM
Description updated. Title updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix node_cnt race between extent node destroy and writeback f2fs_destroy_extent_node() does not set FI_NO_EXTENT before clearing extent nodes. When called from f2fs_drop_inode() with I_SYNC set, concurrent kworker writeback can insert new extent nodes into the same extent tree, racing with the destroy and triggering f2fs_bug_on() in __destroy_extent_node(). The scenario is as follows: drop inode writeback - iput - f2fs_drop_inode // I_SYNC set - f2fs_destroy_extent_node - __destroy_extent_node - while (node_cnt) { write_lock(&et->lock) __free_extent_tree write_unlock(&et->lock) - __writeback_single_inode - f2fs_outplace_write_data - f2fs_update_read_extent_cache - __update_extent_tree_range // FI_NO_EXTENT not set, // insert new extent node } // node_cnt == 0, exit while - f2fs_bug_on(node_cnt) // node_cnt > 0 Additionally, __update_extent_tree_range() only checks FI_NO_EXTENT for EX_READ type, leaving EX_BLOCK_AGE updates completely unprotected. This patch set FI_NO_EXTENT under et->lock in __destroy_extent_node(), consistent with other callers (__update_extent_tree_range and __drop_extent_tree) and check FI_NO_EXTENT for both EX_READ and EX_BLOCK_AGE tree. | This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
| Title | f2fs: fix node_cnt race between extent node destroy and writeback | kernel: f2fs: fix node_cnt race between extent node destroy and writeback |
Jun 10, 2026 7:30 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
May 29, 2026 4:15 AM
Weaknesses updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-362 |
May 29, 2026 12:15 AM
Weaknesses updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-367 | |
| References |
|
May 28, 2026 1:00 PM
Weaknesses updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-362 |
May 28, 2026 10:15 AM
Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix node_cnt race between extent node destroy and writeback f2fs_destroy_extent_node() does not set FI_NO_EXTENT before clearing extent nodes. When called from f2fs_drop_inode() with I_SYNC set, concurrent kworker writeback can insert new extent nodes into the same extent tree, racing with the destroy and triggering f2fs_bug_on() in __destroy_extent_node(). The scenario is as follows: drop inode writeback - iput - f2fs_drop_inode // I_SYNC set - f2fs_destroy_extent_node - __destroy_extent_node - while (node_cnt) { write_lock(&et->lock) __free_extent_tree write_unlock(&et->lock) - __writeback_single_inode - f2fs_outplace_write_data - f2fs_update_read_extent_cache - __update_extent_tree_range // FI_NO_EXTENT not set, // insert new extent node } // node_cnt == 0, exit while - f2fs_bug_on(node_cnt) // node_cnt > 0 Additionally, __update_extent_tree_range() only checks FI_NO_EXTENT for EX_READ type, leaving EX_BLOCK_AGE updates completely unprotected. This patch set FI_NO_EXTENT under et->lock in __destroy_extent_node(), consistent with other callers (__update_extent_tree_range and __drop_extent_tree) and check FI_NO_EXTENT for both EX_READ and EX_BLOCK_AGE tree. | |
| Title | f2fs: fix node_cnt race between extent node destroy and writeback | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
|
Subscriptions
Weaknesses
