CVE-2026-46175: f2fs: fix fsck inconsistency caused by FGGC of node block
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix fsck inconsistency caused by FGGC of node block
During FGGC node block migration, fsck may incorrectly treat the
migrated node block as fsync-written data.
The reproduction scenario:
root@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync
root@vm:/mnt/f2fs# rm -f 1
root@vm:/mnt/f2fs# sync
root@vm:/mnt/f2fs# f2fs_io gc_range // move data block in sync mode and not write CP
SPO, "fsck --dry-run" find inode has already checkpointed but still
with DENT_BIT_SHIFT set
The root cause is that GC does not clear the dentry mark and fsync mark
during node block migration, leading fsck to misinterpret them as
user-issued fsync writes.
In BGGC mode, node block migration is handled by f2fs_sync_node_pages(),
which guarantees the dentry and fsync marks are cleared before writing.
This patch move the set/clear of the fsync|dentry marks into
__write_node_folio to make the logic clearer, and ensures the
fsync|dentry mark is cleared in FGGC.
Security readout for executives and security teams
Plain-English summary
A Linux F2FS garbage-collection flaw can leave filesystem metadata in an inconsistent state. A later integrity check may mistake migrated node blocks for intentionally synchronized data, potentially affecting data integrity and system availability. The supplied record rates it 7.1 High, but does not establish remote or active exploitation.
Executive priority
Treat as a high-priority reliability and data-integrity update for systems using F2FS, especially critical or power-loss-prone devices. Systems without F2FS are not indicated as exposed. Schedule remediation through normal kernel maintenance, escalating where filesystem corruption could cause material downtime or data loss.
Technical view
Foreground garbage collection fails to clear dentry and fsync marks while migrating F2FS node blocks. Consequently, fsck can misclassify migrated blocks after an uncheckpointed interruption, such as sudden power loss. The kernel patches move mark handling into __write_node_folio and ensure both marks are cleared during FGGC.
Likely exposure
Exposure is limited to Linux systems using F2FS and vulnerable kernel revisions, particularly where foreground garbage collection migrates node blocks. The supplied version data is ambiguous, so administrators should map distribution kernels and backports against the referenced stable commits rather than rely only on version numbers.
Exploitation context
The CVSS vector requires local access and low privileges, with no user interaction. KEV is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The documented failure depends on filesystem activity, foreground garbage collection, and loss of an uncheckpointed state.
Researcher notes
The described bug is an FGGC/BGGC behavioral inconsistency: BGGC already clears the marks through f2fs_sync_node_pages. The record demonstrates fsck inconsistency after interruption but does not quantify practical corruption, persistence, or exploitability beyond the CVSS assessment. Affected-version entries appear irregular and require commit-level verification.
Mitigation direction
Install a vendor-supported kernel containing the referenced F2FS correction.
Check distribution advisories because kernel vendors may backport fixes without changing upstream version numbering.
Prioritize F2FS hosts where unexpected shutdowns could disrupt critical services.
Maintain tested backups and controlled shutdown protections until remediation is confirmed.
Validation and detection
Inventory mounted F2FS filesystems and their running kernel builds.
Compare each kernel's source or vendor changelog with the three referenced stable fixes.
Confirm the updated kernel is running after maintenance.
Perform vendor-approved offline or dry-run filesystem consistency checks on potentially affected volumes.
Monitor for F2FS, fsck, metadata, or mount errors after restart.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-46175 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
4Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.