All vulnerabilities
CVE-2026-97534

Linux: f2fs: accurately adjust free_sections during free_segment_range

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in64a7ed42e9766886dd7300597d90366dfb7a1e53Also 8a123a10770d2132d046748f20f02baa8d5539a1, 8c963d1738fdca400082ff5f9d99e083de4f4e70CVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 64a7ed42e9766886dd7300597d90366dfb7a1e53LinuxCVE List
  • 8a123a10770d2132d046748f20f02baa8d5539a1LinuxCVE List
  • 8c963d1738fdca400082ff5f9d99e083de4f4e70LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: accurately adjust free_sections during free_segment_range

In free_segment_range(), MAIN_SECS(sbi) is temporarily reduced by secs to restrict block allocation to the safe remaining main area while valid blocks in the truncated range are evacuated by GC.

However, FREE_I(sbi)->free_sections tracks the total number of free sections across the whole filesystem. If any sections within the truncated range were already free upon entering free_segment_range(), failing to deduct them from free_sections causes the filesystem to overestimate available free sections in the active, reduced main area. This leads to inconsistent free section accounting during GC data migration and can trigger unexpected allocation failures or assertion errors when space is tight.

Fix this by calculating the number of already-free sections in the truncated range, deducting them from free_sections upon entering free_segment_range(), and restoring them on exit.

Text from CVE List

Affected versions 12

  • Linuxaffected: b4b10061ef98c583bcf82a4200703fbaa98c18dc before 64a7ed42e9766886dd7300597d90366dfb7a1e53CVE List
  • Linuxaffected: b4b10061ef98c583bcf82a4200703fbaa98c18dc before faeb0a20bdd113311519b598dcc075af3b6fb366CVE List
  • Linuxaffected: b4b10061ef98c583bcf82a4200703fbaa98c18dc before ca31116fad0954c61a0d38163cc51c48e4981b75CVE List
  • Linuxaffected: b4b10061ef98c583bcf82a4200703fbaa98c18dc before 8a123a10770d2132d046748f20f02baa8d5539a1CVE List
  • Linuxaffected: b4b10061ef98c583bcf82a4200703fbaa98c18dc before 8c963d1738fdca400082ff5f9d99e083de4f4e70CVE List
  • Linuxaffected: 5.8CVE List
  • Linuxunaffected: all versions before 5.8CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5