LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46175: f2fs: fix fsck inconsistency caused by FGGC of node block

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by FGGC of node block During FGGC node block migration, fsck may incorrectly treat the migrated node block as fsync-written data. The reproduction scenario: root@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync root@vm:/mnt/f2fs# rm -f 1 root@vm:/mnt/f2fs# sync root@vm:/mnt/f2fs# f2fs_io gc_range // move data block in sync mode and not write CP SPO, "fsck --dry-run" find inode has already checkpointed but still with DENT_BIT_SHIFT set The root cause is that GC does not clear the dentry mark and fsync mark during node block migration, leading fsck to misinterpret them as user-issued fsync writes. In BGGC mode, node block migration is handled by f2fs_sync_node_pages(), which guarantees the dentry and fsync marks are cleared before writing. This patch move the set/clear of the fsync|dentry marks into __write_node_folio to make the logic clearer, and ensures the fsync|dentry mark is cleared in FGGC.

HighCVSS 7.1Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux F2FS garbage-collection flaw can leave filesystem metadata in an inconsistent state. A later integrity check may mistake migrated node blocks for intentionally synchronized data, potentially affecting data integrity and system availability. The supplied record rates it 7.1 High, but does not establish remote or active exploitation.

Executive priority

Treat as a high-priority reliability and data-integrity update for systems using F2FS, especially critical or power-loss-prone devices. Systems without F2FS are not indicated as exposed. Schedule remediation through normal kernel maintenance, escalating where filesystem corruption could cause material downtime or data loss.

Technical view

Foreground garbage collection fails to clear dentry and fsync marks while migrating F2FS node blocks. Consequently, fsck can misclassify migrated blocks after an uncheckpointed interruption, such as sudden power loss. The kernel patches move mark handling into __write_node_folio and ensure both marks are cleared during FGGC.

Likely exposure

Exposure is limited to Linux systems using F2FS and vulnerable kernel revisions, particularly where foreground garbage collection migrates node blocks. The supplied version data is ambiguous, so administrators should map distribution kernels and backports against the referenced stable commits rather than rely only on version numbers.

Exploitation context

The CVSS vector requires local access and low privileges, with no user interaction. KEV is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The documented failure depends on filesystem activity, foreground garbage collection, and loss of an uncheckpointed state.

Researcher notes

The described bug is an FGGC/BGGC behavioral inconsistency: BGGC already clears the marks through f2fs_sync_node_pages. The record demonstrates fsck inconsistency after interruption but does not quantify practical corruption, persistence, or exploitability beyond the CVSS assessment. Affected-version entries appear irregular and require commit-level verification.

Mitigation direction

  • Install a vendor-supported kernel containing the referenced F2FS correction.
  • Check distribution advisories because kernel vendors may backport fixes without changing upstream version numbering.
  • Prioritize F2FS hosts where unexpected shutdowns could disrupt critical services.
  • Maintain tested backups and controlled shutdown protections until remediation is confirmed.

Validation and detection

  • Inventory mounted F2FS filesystems and their running kernel builds.
  • Compare each kernel's source or vendor changelog with the three referenced stable fixes.
  • Confirm the updated kernel is running after maintenance.
  • Perform vendor-approved offline or dry-run filesystem consistency checks on potentially affected volumes.
  • Monitor for F2FS, fsck, metadata, or mount errors after restart.
Prepared
Confidence
high
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46175 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H1.85.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2026-46175Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxda011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f, da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5f, da011cc0da8cf4a60ddf4d2ae8b42902a3d71e5funaffected
LinuxLinux4.7, 0, 6.18.30, 7.0.7, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.