CVE-2024-26869 (GCVE-0-2024-26869)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:27 – Updated: 2026-08-05 11:28
VLAI
Title
f2fs: fix to truncate meta inode pages forcely
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate meta inode pages forcely Below race case can cause data corruption: Thread A GC thread - gc_data_segment - ra_data_block - locked meta_inode page - f2fs_inplace_write_data - invalidate_mapping_pages : fail to invalidate meta_inode page due to lock failure or dirty|writeback status - f2fs_submit_page_bio : write last dirty data to old blkaddr - move_data_block - load old data from meta_inode page - f2fs_submit_page_write : write old data to new blkaddr Because invalidate_mapping_pages() will skip invalidating page which has unclear status including locked, dirty, writeback and so on, so we need to use truncate_inode_pages_range() instead of invalidate_mapping_pages() to make sure meta_inode page will be dropped.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-12 17:28 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6aa58d8ad20a3323f42274c25820a6f54192422d , < c92f2927df860a60ba815d3ee610a944b92a8694 (git)
Affected: 6aa58d8ad20a3323f42274c25820a6f54192422d , < 77bfdb89cc222fc7bfe198eda77bdc427d5ac189 (git)
Affected: 6aa58d8ad20a3323f42274c25820a6f54192422d , < 04226d8e3c4028dc451e9d8777356ec0f7919253 (git)
Affected: 6aa58d8ad20a3323f42274c25820a6f54192422d , < 9f0c4a46be1fe9b97dbe66d49204c1371e3ece65 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.19
Unaffected: 0 , < 4.19 (semver)
Unaffected: 6.6.23 , ≤ 6.6.* (semver)
Unaffected: 6.7.11 , ≤ 6.7.* (semver)
Unaffected: 6.8.2 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T17:28:33.962208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T17:31:41.499Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:04.218Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/checkpoint.c",
            "fs/f2fs/f2fs.h",
            "fs/f2fs/segment.c",
            "include/linux/f2fs_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c92f2927df860a60ba815d3ee610a944b92a8694",
              "status": "affected",
              "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
              "versionType": "git"
            },
            {
              "lessThan": "77bfdb89cc222fc7bfe198eda77bdc427d5ac189",
              "status": "affected",
              "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
              "versionType": "git"
            },
            {
              "lessThan": "04226d8e3c4028dc451e9d8777356ec0f7919253",
              "status": "affected",
              "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
              "versionType": "git"
            },
            {
              "lessThan": "9f0c4a46be1fe9b97dbe66d49204c1371e3ece65",
              "status": "affected",
              "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/checkpoint.c",
            "fs/f2fs/f2fs.h",
            "fs/f2fs/segment.c",
            "include/linux/f2fs_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate meta inode pages forcely\n\nBelow race case can cause data corruption:\n\nThread A\t\t\t\tGC thread\n\t\t\t\t\t- gc_data_segment\n\t\t\t\t\t - ra_data_block\n\t\t\t\t\t  - locked meta_inode page\n- f2fs_inplace_write_data\n - invalidate_mapping_pages\n : fail to invalidate meta_inode page\n   due to lock failure or dirty|writeback\n   status\n - f2fs_submit_page_bio\n : write last dirty data to old blkaddr\n\t\t\t\t\t - move_data_block\n\t\t\t\t\t  - load old data from meta_inode page\n\t\t\t\t\t  - f2fs_submit_page_write\n\t\t\t\t\t  : write old data to new blkaddr\n\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable paths are entered through ordinary local file operations on a mounted f2fs volume \u2014 buffered overwrite with IPU, fdatasync, or O_DIRECT write \u2014 with the racing side driven by the in-kernel GC thread. No network or physical access is involved.\nAC:L - The attacker controls the write side outright and can drive the GC side at will by fragmenting/filling the filesystem to keep background and foreground GC continuously active; the invalidation failure window is the full duration of GC\u0027s read bio, during which ra_data_block() holds the meta page locked, so the skip is the expected outcome rather than a narrow accident, and the attempt can be repeated indefinitely.\nPR:L - Any unprivileged local user with write access to a file on an f2fs volume can reach both f2fs_inplace_write_data() and the F2FS_GET_BLOCK_DIO path; the CAP_SYS_ADMIN check on f2fs_ioc_gc() is not a barrier because the default background GC thread and f2fs_balance_fs()-triggered foreground GC provide the racing side without any privilege.\nUI:N - The attacker\u0027s own process performs the writes and the GC thread runs automatically as a kernel thread; no victim action of any kind is required.\nS:U - The corruption is confined to the f2fs filesystem and kernel managing it, with no crossing into a different security authority such as a hypervisor or IOMMU domain.\nC:H - META_MAPPING is a global cache keyed by physical block address, and f2fs_invalidate_blocks() can likewise fail to evict, so a stale page can outlive the block\u0027s reallocation to a different inode \u2014 move_data_block() then copies the previous owner\u0027s on-disk content into the attacker\u0027s file, disclosing another user\u0027s data (plaintext for verity/compressed inodes).\nI:H - This is a direct, silent, persistent on-disk data corruption primitive: freshly written data is overwritten with stale contents, and via physical-block reuse an attacker\u0027s stale data can be written into another inode\u0027s blocks, modifying data outside the attacker\u0027s control with no error reported.\nA:H - Corrupted blocks landing in compressed clusters or encrypted directory/dentry blocks produce decompression and directory-parse failures that raise EFSCORRUPTED, set SBI_NEED_FSCK, and trigger f2fs_handle_error() shutdown (panic under errors=panic or CONFIG_F2FS_CHECK_FS), alongside irrecoverable loss of the corrupted file data."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:00.887Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"
        },
        {
          "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"
        },
        {
          "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"
        }
      ],
      "title": "f2fs: fix to truncate meta inode pages forcely",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26869",
    "datePublished": "2024-04-17T10:27:30.100Z",
    "dateReserved": "2024-02-19T14:20:24.184Z",
    "dateUpdated": "2026-08-05T11:28:00.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26869",
      "date": "2026-09-25",
      "epss": "0.0018",
      "percentile": "0.06692"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate meta inode pages forcely\n\nBelow race case can cause data corruption:\n\nThread A\t\t\t\tGC thread\n\t\t\t\t\t- gc_data_segment\n\t\t\t\t\t - ra_data_block\n\t\t\t\t\t  - locked meta_inode page\n- f2fs_inplace_write_data\n - invalidate_mapping_pages\n : fail to invalidate meta_inode page\n   due to lock failure or dirty|writeback\n   status\n - f2fs_submit_page_bio\n : write last dirty data to old blkaddr\n\t\t\t\t\t - move_data_block\n\t\t\t\t\t  - load old data from meta_inode page\n\t\t\t\t\t  - f2fs_submit_page_write\n\t\t\t\t\t  : write old data to new blkaddr\n\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: correcci\u00f3n para truncar las p\u00e1ginas de meta-inodo a la fuerza El siguiente caso de carrera puede causar corrupci\u00f3n de datos: Hilo Un hilo de GC - gc_data_segment - ra_data_block - p\u00e1gina de meta_inodo bloqueada - f2fs_inplace_write_data - invalidate_mapping_pages: no se puede invalidar meta_inode p\u00e1gina debido a falla de bloqueo o estado sucio|reescritura - f2fs_submit_page_bio: escribe los \u00faltimos datos sucios en el blkaddr antiguo - move_data_block - carga datos antiguos de la p\u00e1gina meta_inode - f2fs_submit_page_write: escribe datos antiguos en el blkaddr nuevo Porque invalidate_mapping_pages() omitir\u00e1 la p\u00e1gina de invalidaci\u00f3n cuyo estado no est\u00e1 claro incluyendo bloqueado, sucio, reescritura, etc., por lo que debemos usar truncate_inode_pages_range() en lugar de invalidate_mapping_pages() para asegurarnos de que la p\u00e1gina meta_inode se elimine."
        }
      ],
      "id": "CVE-2024-26869",
      "lastModified": "2024-11-21T09:03:15.370",
      "published": "2024-04-17T11:15:09.413",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:53:18.000Z",
      "cve": "CVE-2024-26869",
      "id": "msrc_CVE-2024-26869",
      "initial_release_date": "2024-04-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "f2fs: fix to truncate meta inode pages forcely",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26869.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/checkpoint.c",
                  "fs/f2fs/f2fs.h",
                  "fs/f2fs/segment.c",
                  "include/linux/f2fs_fs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c92f2927df860a60ba815d3ee610a944b92a8694",
                    "status": "affected",
                    "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "77bfdb89cc222fc7bfe198eda77bdc427d5ac189",
                    "status": "affected",
                    "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "04226d8e3c4028dc451e9d8777356ec0f7919253",
                    "status": "affected",
                    "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f0c4a46be1fe9b97dbe66d49204c1371e3ece65",
                    "status": "affected",
                    "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/checkpoint.c",
                  "fs/f2fs/f2fs.h",
                  "fs/f2fs/segment.c",
                  "include/linux/f2fs_fs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.19"
                  },
                  {
                    "lessThan": "4.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.23",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3E5CF199-446C-49E6-B4B3-115B6F6567B6",
                    "versionEndExcluding": "6.6.23",
                    "versionStartIncluding": "4.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B95D3A6-E162-47D5-ABFC-F3FA74FA7CFD",
                    "versionEndExcluding": "6.7.11",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "543A75FF-25B8-4046-A514-1EA8EDD87AB1",
                    "versionEndExcluding": "6.8.2",
                    "versionStartIncluding": "6.8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate meta inode pages forcely\n\nBelow race case can cause data corruption:\n\nThread A\t\t\t\tGC thread\n\t\t\t\t\t- gc_data_segment\n\t\t\t\t\t - ra_data_block\n\t\t\t\t\t  - locked meta_inode page\n- f2fs_inplace_write_data\n - invalidate_mapping_pages\n : fail to invalidate meta_inode page\n   due to lock failure or dirty|writeback\n   status\n - f2fs_submit_page_bio\n : write last dirty data to old blkaddr\n\t\t\t\t\t - move_data_block\n\t\t\t\t\t  - load old data from meta_inode page\n\t\t\t\t\t  - f2fs_submit_page_write\n\t\t\t\t\t  : write old data to new blkaddr\n\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: f2fs: correcci\u00f3n para truncar las p\u00e1ginas de meta-inodo a la fuerza El siguiente caso de carrera puede causar corrupci\u00f3n de datos: Hilo Un hilo de GC - gc_data_segment - ra_data_block - p\u00e1gina de meta_inodo bloqueada - f2fs_inplace_write_data - invalidate_mapping_pages: no se puede invalidar meta_inode p\u00e1gina debido a falla de bloqueo o estado sucio|reescritura - f2fs_submit_page_bio: escribe los \u00faltimos datos sucios en el blkaddr antiguo - move_data_block - carga datos antiguos de la p\u00e1gina meta_inode - f2fs_submit_page_write: escribe datos antiguos en el blkaddr nuevo Porque invalidate_mapping_pages() omitir\u00e1 la p\u00e1gina de invalidaci\u00f3n cuyo estado no est\u00e1 claro incluyendo bloqueado, sucio, reescritura, etc., por lo que debemos usar truncate_inode_pages_range() en lugar de invalidate_mapping_pages() para asegurarnos de que la p\u00e1gina meta_inode se elimine."
          }
        ],
        "id": "CVE-2024-26869",
        "lastModified": "2026-08-04T11:17:15.500",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-26869",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T17:28:33.962208Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-17T11:15:09.413",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:09:25+00:00",
      "cve": "CVE-2024-26869",
      "id": "CVE-2024-26869",
      "initial_release_date": "2024-04-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: f2fs: fix to truncate meta inode pages forcely",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26869.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:57:55Z",
      "cve": "CVE-2024-26869",
      "id": "CVE-2024-26869",
      "initial_release_date": "2024-04-20T02:08:50Z",
      "product_status:known_not_affected": "366",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26869",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26869.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:21:04.218Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-26869",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-12T17:28:33.962208Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-12T17:28:41.121Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/f2fs/checkpoint.c",
                "fs/f2fs/f2fs.h",
                "fs/f2fs/segment.c",
                "include/linux/f2fs_fs.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "c92f2927df860a60ba815d3ee610a944b92a8694",
                  "status": "affected",
                  "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
                  "versionType": "git"
                },
                {
                  "lessThan": "77bfdb89cc222fc7bfe198eda77bdc427d5ac189",
                  "status": "affected",
                  "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
                  "versionType": "git"
                },
                {
                  "lessThan": "04226d8e3c4028dc451e9d8777356ec0f7919253",
                  "status": "affected",
                  "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
                  "versionType": "git"
                },
                {
                  "lessThan": "9f0c4a46be1fe9b97dbe66d49204c1371e3ece65",
                  "status": "affected",
                  "version": "6aa58d8ad20a3323f42274c25820a6f54192422d",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/f2fs/checkpoint.c",
                "fs/f2fs/f2fs.h",
                "fs/f2fs/segment.c",
                "include/linux/f2fs_fs.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.19"
                },
                {
                  "lessThan": "4.19",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.23",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.11",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.23",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.11",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.2",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "4.19",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to truncate meta inode pages forcely\n\nBelow race case can cause data corruption:\n\nThread A\t\t\t\tGC thread\n\t\t\t\t\t- gc_data_segment\n\t\t\t\t\t - ra_data_block\n\t\t\t\t\t  - locked meta_inode page\n- f2fs_inplace_write_data\n - invalidate_mapping_pages\n : fail to invalidate meta_inode page\n   due to lock failure or dirty|writeback\n   status\n - f2fs_submit_page_bio\n : write last dirty data to old blkaddr\n\t\t\t\t\t - move_data_block\n\t\t\t\t\t  - load old data from meta_inode page\n\t\t\t\t\t  - f2fs_submit_page_write\n\t\t\t\t\t  : write old data to new blkaddr\n\nBecause invalidate_mapping_pages() will skip invalidating page which\nhas unclear status including locked, dirty, writeback and so on, so\nwe need to use truncate_inode_pages_range() instead of\ninvalidate_mapping_pages() to make sure meta_inode page will be dropped."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable paths are entered through ordinary local file operations on a mounted f2fs volume \u2014 buffered overwrite with IPU, fdatasync, or O_DIRECT write \u2014 with the racing side driven by the in-kernel GC thread. No network or physical access is involved.\nAC:L - The attacker controls the write side outright and can drive the GC side at will by fragmenting/filling the filesystem to keep background and foreground GC continuously active; the invalidation failure window is the full duration of GC\u0027s read bio, during which ra_data_block() holds the meta page locked, so the skip is the expected outcome rather than a narrow accident, and the attempt can be repeated indefinitely.\nPR:L - Any unprivileged local user with write access to a file on an f2fs volume can reach both f2fs_inplace_write_data() and the F2FS_GET_BLOCK_DIO path; the CAP_SYS_ADMIN check on f2fs_ioc_gc() is not a barrier because the default background GC thread and f2fs_balance_fs()-triggered foreground GC provide the racing side without any privilege.\nUI:N - The attacker\u0027s own process performs the writes and the GC thread runs automatically as a kernel thread; no victim action of any kind is required.\nS:U - The corruption is confined to the f2fs filesystem and kernel managing it, with no crossing into a different security authority such as a hypervisor or IOMMU domain.\nC:H - META_MAPPING is a global cache keyed by physical block address, and f2fs_invalidate_blocks() can likewise fail to evict, so a stale page can outlive the block\u0027s reallocation to a different inode \u2014 move_data_block() then copies the previous owner\u0027s on-disk content into the attacker\u0027s file, disclosing another user\u0027s data (plaintext for verity/compressed inodes).\nI:H - This is a direct, silent, persistent on-disk data corruption primitive: freshly written data is overwritten with stale contents, and via physical-block reuse an attacker\u0027s stale data can be written into another inode\u0027s blocks, modifying data outside the attacker\u0027s control with no error reported.\nA:H - Corrupted blocks landing in compressed clusters or encrypted directory/dentry blocks produce decompression and directory-parse failures that raise EFSCORRUPTED, set SBI_NEED_FSCK, and trigger f2fs_handle_error() shutdown (panic under errors=panic or CONFIG_F2FS_CHECK_FS), alongside irrecoverable loss of the corrupted file data."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:28:00.887Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/c92f2927df860a60ba815d3ee610a944b92a8694"
            },
            {
              "url": "https://git.kernel.org/stable/c/77bfdb89cc222fc7bfe198eda77bdc427d5ac189"
            },
            {
              "url": "https://git.kernel.org/stable/c/04226d8e3c4028dc451e9d8777356ec0f7919253"
            },
            {
              "url": "https://git.kernel.org/stable/c/9f0c4a46be1fe9b97dbe66d49204c1371e3ece65"
            }
          ],
          "title": "f2fs: fix to truncate meta inode pages forcely",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-26869",
        "datePublished": "2024-04-17T10:27:30.100Z",
        "dateReserved": "2024-02-19T14:20:24.184Z",
        "dateUpdated": "2026-08-05T11:28:00.887Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.