f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388: F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache. This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.12.95, 6.18.38, 6.6.144, 7.1.3
- CVEs
- CVE-2026-63812
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 08:57 UTC · Revision 1
Source evidence
f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
core-osv · Original sourcePublished 19 Jul 2026, 12:02 UTC
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388: F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache. This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.
osv:CVE-2026-63812
Kernel
Fixed versions: 6.6.144, 6.12.95, 6.18.38, 7.1.3
Complete source record
{
"id": "e9bbdada777fc2375302962675c26d02ac18d5e23ef4282f5da7508b29d90f0e",
"url": "https://osv.dev/vulnerability/CVE-2026-63812",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388: F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache. This patch reverts commit ed78aeebef05 (\"f2fs: fix node_cnt race between extent node destroy and writeback\"), and remove the unnecessary zero check of et->node_cnt.",
"evidence": "osv:CVE-2026-63812",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.6.144",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.95",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.38",
"evidence": "/affected/1/ranges"
},
{
"value": "7.1.3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-63812",
"aliases": [
"CVE-2026-63812"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "42dd1c91f993431d0b399502479d00e6ad1bca71"
},
{
"fixed": "7e4d8f98be63f98856a5176b9188dada6e7ba9ee"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ab1eaf9d5c99042f5b0243bf67a06283a4c0757f"
},
{
"fixed": "58a5deb220bcac4c73bf58954c0845644c997487"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "b0e4395870eb3441ddc959f6710b5f6ca61aff26"
},
{
"fixed": "20190e498057997532c7f186d081011f18e0a462"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "ed78aeebef05212ef7dca93bd931e4eff67c113f"
},
{
"fixed": "edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7"
},
{
"fixed": "1f70ddb28a3c71df124da5fa4040c808116d6bb9"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.6.140"
},
{
"fixed": "6.6.144"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.12.88"
},
{
"fixed": "6.12.95"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.18.30"
},
{
"fixed": "6.18.38"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "7.0.7"
},
{
"fixed": "7.1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "0559a0e962aacbb47519e26ee663be04b72dcb92"
}
]
}
],
"versions": [
"v6.6.143",
"v6.6.142",
"v6.6.141",
"v6.6.140",
"v6.12.94",
"v6.12.93",
"v6.12.92",
"v6.12.91",
"v6.12.90",
"v6.12.89",
"v6.12.88",
"v6.18.37",
"v6.18.36",
"v6.18.35",
"v6.18.34",
"v6.18.33",
"v6.18.32",
"v6.18.31",
"v6.18.30",
"v7.0.14",
"v7.0.13",
"v7.0.12",
"v7.0.11",
"v7.0.10",
"v7.0.9",
"v7.0.8",
"v7.0.7"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63812.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.144"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.95"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.38"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.3"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63812.json"
}
}
],
"modified": "2026-10-08T02:51:28.854273182Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/1f70ddb28a3c71df124da5fa4040c808116d6bb9",
"https://git.kernel.org/stable/c/20190e498057997532c7f186d081011f18e0a462",
"https://git.kernel.org/stable/c/58a5deb220bcac4c73bf58954c0845644c997487",
"https://git.kernel.org/stable/c/7e4d8f98be63f98856a5176b9188dada6e7ba9ee",
"https://git.kernel.org/stable/c/edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63812.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-63812",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63812.json"
}
},
"related_cves": [
{
"value": "CVE-2026-63812",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 98313,
"published_at": "2026-07-19T12:02:13.606+00:00"
}