In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix incorrect FINOEXTENT handling in __destroyextentnode()
When __destroyextentnode() sets the inode flag FINOEXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388:
F2FS-fs (dm-0): sanitycheckextent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix
In the f2fsdropinode path, _destroyextentnode() does not need to guarantee that et->nodecnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache.
This patch reverts commit ed78aeebef05 ("f2fs: fix nodecnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->nodecnt.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63812.json",
"cna_assigner": "Linux"
}