CVE-2026-53303

Source
https://cve.org/CVERecord?id=CVE-2026-53303
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53303.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53303
Downstream
Published
2026-06-26T19:40:59.383Z
Modified
2026-07-08T08:07:25.198416695Z
Summary
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
Details

In the Linux kernel, the following vulnerability has been resolved:

f2fs: protect extensionlist reading with sblock in f2fssbishow()

In f2fssbishow(), the extensionlist, extensioncount and hotextcount are read without holding sbi->sblock. If a concurrent sysfs store modifies the extension list via f2fsupdateextensionlist(), the show path may read inconsistent count and array contents, potentially leading to out-of-bounds access or displaying stale data.

Fix this by holding sb_lock around the entire extension list read and format operation.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53303.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b6a06cbbb5f7fd03589cff9178314af04c568826
Fixed
d3ff0c121bbaef026df6248ab7ef6f0b068b0647
Fixed
cea15f66b7b68b2c50943a6660e0692c6635e4eb
Fixed
4b3a1bf4c2ffd4c9595d900ead78c9035894a025
Fixed
d0e877810baf613b018fd9747440b9d4d9db1428
Fixed
ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92e
Fixed
5909bedbed38c558bee7cb6758ceedf9bc3a9194

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53303.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.17.0
Fixed
6.1.175
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.141
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.91
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.33
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.10

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53303.json"