CVE-2026-53018f2fs: avoid reading already updated pages during GC
- 5.5MediumCVSS base score
- 0.16%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid reading already updated pages during GC We found the following issue during fuzz testing: page: refcount:3 mapcount:0 mapping:00000000b6e89c65 index:0x18b2dc pfn:0x161ba9 memcg:f8ffff800e269c00 aops:f2fs_meta_aops ino:2 flags: 0x52880000000080a9(locked|waiters|uptodate|lru|private|zone=1|kasantag=0x4a) raw: 52880000000080a9 fffffffec6e17588 fffffffec0ccc088 a7ffff8067063618 raw: 000000000018b2dc 0000000000000009 00000003ffffffff f8ffff800e269c00 page dumped because: VM_BUG_ON_FOLIO(folio_test_uptodate(folio)) page_owner tracks the page as allocated post_alloc_hook+0x58c/0x5ec prep_new_page+0x34/0x284 get_page_from_freelist+0x2dcc/0x2e8c __alloc_pages_noprof+0x280/0x76c __folio_alloc_noprof+0x18/0xac __filemap_get_folio+0x6bc/0xdc4 pagecache_get_page+0x3c/0x104 do_garbage_collect+0x5c78/0x77a4 f2fs_gc+0xd74/0x25f0 gc_thread_func+0xb28/0x2930 kthread+0x464/0x5d8 ret_from_fork+0x10/0x20 ------------[ cut here ]------------ kernel BUG at mm/filemap.c:1563! folio_end_read+0x140/0x168 f2fs_finish_read_bio+0x5c4/0xb80 f2fs_read_end_io+0x64c/0x708 bio_endio+0x85c/0x8c0 blk_update_request+0x690/0x127c scsi_end_request+0x9c/0xb8c scsi_io_completion+0xf0/0x250 scsi_finish_command+0x430/0x45c scsi_complete+0x178/0x6d4 blk_mq_complete_request+0xcc/0x104 scsi_done_internal+0x214/0x454 scsi_done+0x24/0x34 which is similar to the problem reported by syzbot: https://syzkaller.appspot.com/bug?extid=3686758660f980b402dc This case is consistent with the description in commit 9bf1a3f ("f2fs: avoid GC causing encrypted file corrupted"): Page 1 is moved from blkaddr A to blkaddr B by move_data_block, and after being written it is marked as uptodate. Then, Page 1 is moved from blkaddr B to blkaddr C, VM_BUG_ON_FOLIO was triggered in the endio initiated by ra_data_block. There is no need to read Page 1 again from blkaddr B, since it has already been updated. Therefore, avoid initiating I/O in this case.
Timeline
ID reserved
By Linux
- 15 days later
· 15 days later
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 6aa58d8ad20a3323f42274c25820a6f54192422d – < ecf53b5c9ccba6e6a7db111722cc8bbfc92d4558
- affected 6aa58d8ad20a3323f42274c25820a6f54192422d – < c260c874a6d578a45105f98089b1f0db5c6ff0a3
- affected 6aa58d8ad20a3323f42274c25820a6f54192422d – < 08423a9564d92e51505763b6b2f47b3da8b0a355
- affected 6aa58d8ad20a3323f42274c25820a6f54192422d – < 4623c251496b99c530ce225c05334f4eac8b933a
- affected 6aa58d8ad20a3323f42274c25820a6f54192422d – < b663ebb8a340eae5442e605b6acd2cff5677f016
- affected 6aa58d8ad20a3323f42274c25820a6f54192422d – < 570e2ccc7cb35fe720106964e65060602d3d2ac4
- affected 4.19
- unaffected < 4.19
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.33 – ≤ 6.18.*
- unaffected 7.0.10 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References6
- https://git.kernel.org/stable/c/ecf53b5c9ccba6e6a7db111722cc8bbfc92d4558 (opens in a new tab)
- https://git.kernel.org/stable/c/c260c874a6d578a45105f98089b1f0db5c6ff0a3 (opens in a new tab)
- https://git.kernel.org/stable/c/08423a9564d92e51505763b6b2f47b3da8b0a355 (opens in a new tab)
- https://git.kernel.org/stable/c/4623c251496b99c530ce225c05334f4eac8b933a (opens in a new tab)
- https://git.kernel.org/stable/c/b663ebb8a340eae5442e605b6acd2cff5677f016 (opens in a new tab)
- https://git.kernel.org/stable/c/570e2ccc7cb35fe720106964e65060602d3d2ac4 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-38886 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-53018)Record last updated .