CVE-2026-53368

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53368", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.400Z", "datePublished": "2026-07-19T09:10:29.573Z", "dateUpdated": "2026-10-30T12:27:04.292Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:27:04.292Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage\n\nf2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion\nwith the checkpoint path, which can result in an incorrect inode block\nmarking state. The scenario is as follows:\n\ncreate & write & fsync 'file A' write checkpoint\n- f2fs_do_sync_file // inline inode\n - f2fs_write_inode // inode folio is dirty\n - f2fs_write_checkpoint\n - f2fs_flush_merged_writes\n - f2fs_sync_node_pages\n - f2fs_fsync_node_pages // no dirty node\n - f2fs_need_inode_block_update // return true\n - f2fs_fsync_node_pages // inode dirtied\n - f2fs_need_dentry_mark //return true\n - f2fs_flush_nat_entries\n - f2fs_write_checkpoint end\n - __write_node_folio // inode with DENT_BIT_SHIFT set\n SPO, \"fsck --dry-run\" find inode has already checkpointed but still\n with DENT_BIT_SHIFT set\n\nThe state observed by f2fs_need_dentry_mark() can differ from the state\nobserved in __write_node_folio() after acquiring sbi->node_write. The\nroot cause is that the semantics of IS_CHECKPOINTED and\nHAS_FSYNCED_INODE are only guaranteed after the checkpoint write has\nfully completed.\n\nThis patch moves set_dentry_mark() into __write_node_folio() and\nprotects it with the sbi->node_write lock."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached via local filesystem syscalls (fsync/fdatasync on a writable file) on an F2FS mount. F2FS is primarily deployed on local flash storage (Android /data, ChromeOS, embedded), not as a network-facing attack surface.\nAC:L - An attacker controls both sides of the race by concurrently fsyncing an inline inode while triggering a checkpoint (e.g., via sync(2), heavy writeback, or background checkpoint/GC threads). No conditions outside attacker influence are required beyond routine concurrent I/O.\nPR:L - Exploitation requires only unprivileged write access to files on the F2FS filesystem plus the ability to issue fsync/sync syscalls. No CAP_SYS_ADMIN, mount privileges, or init-namespace root are needed.\nUI:N - No victim interaction is required; the attacker performs the write and fsync operations on files they can already modify.\nS:U - The impact is confined to F2FS on-disk metadata and recovery semantics within the same kernel/filesystem security boundary. There is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:N - The bug causes incorrect setting of the DENT_BIT_SHIFT recovery flag on a node block. It does not read kernel memory, leak pointers, or disclose data beyond what the attacker already wrote.\nI:H - The race writes incorrect dentry recovery metadata to disk (checkpointed inode still marked with DENT_BIT_SHIFT), producing fsck-detectable filesystem inconsistency and potentially breaking roll-forward recovery of fsynced data after sudden power-off.\nA:H - Corrupted recovery metadata can cause mount-time recovery failures (as seen in the related atomic-write variant returning -EINVAL from f2fs_recover_inode_page) and fsck-detected inconsistency after power loss, degrading filesystem availability on F2FS-backed systems such as Android devices."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/node.c"], "versions": [{"version": "88bd02c9472a166b706284a34a84f1243322d782", "lessThan": "bb1275802b482bc5854e434e212589fe253eab22", "status": "affected", "versionType": "git"}, {"version": "88bd02c9472a166b706284a34a84f1243322d782", "lessThan": "270c519bca3a59b6140d176415aff16e4e06f9e3", "status": "affected", "versionType": "git"}, {"version": "88bd02c9472a166b706284a34a84f1243322d782", "lessThan": "bedb710b63ae1bd617e65d0a8cf6cea1200b3753", "status": "affected", "versionType": "git"}, {"version": "88bd02c9472a166b706284a34a84f1243322d782", "lessThan": "b28a83ea4934215b5de906c3ee4fbfbc651573e0", "status": "affected", "versionType": "git"}, {"version": "88bd02c9472a166b706284a34a84f1243322d782", "lessThan": "019f9dda7f66e55eb94cd32e1d3fff5835f73fbc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/node.c"], "versions": [{"version": "3.18", "status": "affected"}, {"version": "0", "lessThan": "3.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bb1275802b482bc5854e434e212589fe253eab22"}, {"url": "https://git.kernel.org/stable/c/270c519bca3a59b6140d176415aff16e4e06f9e3"}, {"url": "https://git.kernel.org/stable/c/bedb710b63ae1bd617e65d0a8cf6cea1200b3753"}, {"url": "https://git.kernel.org/stable/c/b28a83ea4934215b5de906c3ee4fbfbc651573e0"}, {"url": "https://git.kernel.org/stable/c/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc"}], "title": "f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/f2fs/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bb1275802b482bc5854e434e212589fe253eab22", "status": "affected", "version": "88bd02c9472a166b706284a34a84f1243322d782", "versionType": "git"}, {"lessThan": "270c519bca3a59b6140d176415aff16e4e06f9e3", "status": "affected", "version": "88bd02c9472a166b706284a34a84f1243322d782", "versionType": "git"}, {"lessThan": "bedb710b63ae1bd617e65d0a8cf6cea1200b3753", "status": "affected", "version": "88bd02c9472a166b706284a34a84f1243322d782", "versionType": "git"}, {"lessThan": "b28a83ea4934215b5de906c3ee4fbfbc651573e0", "status": "affected", "version": "88bd02c9472a166b706284a34a84f1243322d782", "versionType": "git"}, {"lessThan": "019f9dda7f66e55eb94cd32e1d3fff5835f73fbc", "status": "affected", "version": "88bd02c9472a166b706284a34a84f1243322d782", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/f2fs/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.18"}, {"lessThan": "3.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D338BAC-AB8F-4767-B816-F8E37E140F88", "versionEndExcluding": "6.18.30", "versionStartIncluding": "3.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage\n\nf2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion\nwith the checkpoint path, which can result in an incorrect inode block\nmarking state. The scenario is as follows:\n\ncreate & write & fsync 'file A' write checkpoint\n- f2fs_do_sync_file // inline inode\n - f2fs_write_inode // inode folio is dirty\n - f2fs_write_checkpoint\n - f2fs_flush_merged_writes\n - f2fs_sync_node_pages\n - f2fs_fsync_node_pages // no dirty node\n - f2fs_need_inode_block_update // return true\n - f2fs_fsync_node_pages // inode dirtied\n - f2fs_need_dentry_mark //return true\n - f2fs_flush_nat_entries\n - f2fs_write_checkpoint end\n - __write_node_folio // inode with DENT_BIT_SHIFT set\n SPO, \"fsck --dry-run\" find inode has already checkpointed but still\n with DENT_BIT_SHIFT set\n\nThe state observed by f2fs_need_dentry_mark() can differ from the state\nobserved in __write_node_folio() after acquiring sbi->node_write. The\nroot cause is that the semantics of IS_CHECKPOINTED and\nHAS_FSYNCED_INODE are only guaranteed after the checkpoint write has\nfully completed.\n\nThis patch moves set_dentry_mark() into __write_node_folio() and\nprotects it with the sbi->node_write lock."}], "id": "CVE-2026-53368", "lastModified": "2026-10-30T13:19:16.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T09:17:01.903", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/019f9dda7f66e55eb94cd32e1d3fff5835f73fbc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/270c519bca3a59b6140d176415aff16e4e06f9e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b28a83ea4934215b5de906c3ee4fbfbc651573e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bb1275802b482bc5854e434e212589fe253eab22"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bedb710b63ae1bd617e65d0a8cf6cea1200b3753"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage", "id": "2502179", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502179"}, "csaw": false, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nf2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage\nf2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion\nwith the checkpoint path, which can result in an incorrect inode block\nmarking state. The scenario is as follows:\ncreate & write & fsync 'file A' write checkpoint\n- f2fs_do_sync_file // inline inode\n- f2fs_write_inode // inode folio is dirty\n- f2fs_write_checkpoint\n- f2fs_flush_merged_writes\n- f2fs_sync_node_pages\n- f2fs_fsync_node_pages // no dirty node\n- f2fs_need_inode_block_update // return true\n- f2fs_fsync_node_pages // inode dirtied\n- f2fs_need_dentry_mark //return true\n- f2fs_flush_nat_entries\n- f2fs_write_checkpoint end\n- __write_node_folio // inode with DENT_BIT_SHIFT set\nSPO, \"fsck --dry-run\" find inode has already checkpointed but still\nwith DENT_BIT_SHIFT set\nThe state observed by f2fs_need_dentry_mark() can differ from the state\nobserved in __write_node_folio() after acquiring sbi->node_write. The\nroot cause is that the semantics of IS_CHECKPOINTED and\nHAS_FSYNCED_INODE are only guaranteed after the checkpoint write has\nfully completed.\nThis patch moves set_dentry_mark() into __write_node_folio() and\nprotects it with the sbi->node_write lock.", "A flaw was found in the Linux kernel's F2FS (Flash-Friendly File System) component. A race condition exists where the `f2fs_need_dentry_mark()` function incorrectly reads `nat_entry` flags without proper synchronization during checkpoint operations. This can lead to an inconsistent inode block marking state, which may be reported by filesystem check utilities (fsck) as an error, potentially impacting data integrity or system stability."], "name": "CVE-2026-53368", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53368\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53368\nhttps://lore.kernel.org/linux-cve-announce/2026071918-CVE-2026-53368-9e8b@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[88bd02c9472a166b706284a34a84f1243322d782,bedb710b63ae1bd617e65d0a8cf6cea1200b3753)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[88bd02c9472a166b706284a34a84f1243322d782,b28a83ea4934215b5de906c3ee4fbfbc651573e0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[88bd02c9472a166b706284a34a84f1243322d782,019f9dda7f66e55eb94cd32e1d3fff5835f73fbc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T00:30:18.756631+00:00", "updated": "2026-08-12T09:45:01.474890+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}