CVE-2026-46194
- Source
- https://cve.org/CVERecord?id=CVE-2026-46194
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46194.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-46194
- Downstream
- Related
- Published
- 2026-05-28T09:36:47.461Z
- Modified
- 2026-07-08T08:05:17.693346408Z
- Summary
- f2fs: fix node_cnt race between extent node destroy and writeback
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix node_cnt race between extent node destroy and writeback
f2fsdestroyextentnode() does not set FINOEXTENT before clearing extent nodes. When called from f2fsdropinode() with ISYNC set, concurrent kworker writeback can insert new extent nodes into the same extent tree, racing with the destroy and triggering f2fsbugon() in __destroyextentnode(). The scenario is as follows:
drop inode writeback - iput - f2fsdropinode // ISYNC set - f2fsdestroyextentnode - __destroyextentnode - while (nodecnt) { writelock(&et->lock) __freeextenttree write_unlock(&et->lock) - __writebacksingleinode - f2fsoutplacewritedata - f2fsupdatereadextent_cache - __updateextenttreerange // FINOEXTENT not set, // insert new extent node } // nodecnt == 0, exit while - f2fsbugon(nodecnt) // nodecnt > 0
Additionally, __updateextenttreerange() only checks FINOEXTENT for EXREAD type, leaving EXBLOCKAGE updates completely unprotected.
This patch set FINOEXTENT under et->lock in __destroyextentnode(), consistent with other callers (__updateextenttree_range and _dropextenttree) and check FINOEXTENT for both EXREAD and EXBLOCKAGE tree.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46194.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/0559a0e962aacbb47519e26ee663be04b72dcb92
- https://git.kernel.org/stable/c/42dd1c91f993431d0b399502479d00e6ad1bca71
- https://git.kernel.org/stable/c/ab1eaf9d5c99042f5b0243bf67a06283a4c0757f
- https://git.kernel.org/stable/c/b0e4395870eb3441ddc959f6710b5f6ca61aff26
- https://git.kernel.org/stable/c/ed78aeebef05212ef7dca93bd931e4eff67c113f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46194.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-46194
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced295b50e95e900da31ff237e46e04525fa799b2cfFixed42dd1c91f993431d0b399502479d00e6ad1bca71
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced924f7dd1e832e4e4530d14711db223d2803f7b61Fixedab1eaf9d5c99042f5b0243bf67a06283a4c0757f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343Fixedb0e4395870eb3441ddc959f6710b5f6ca61aff26Fixed0559a0e962aacbb47519e26ee663be04b72dcb92Fixeded78aeebef05212ef7dca93bd931e4eff67c113f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.66Fixed6.6.140
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.5Fixed6.12.88