CVE-2026-53303 f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
A race condition in the Linux kernel f2fs filesystem allows concurrent access to cause out-of-bounds reads or stale data exposure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53303?
CVE-2026-53303 is a high-severity vulnerability in Linux kernel, published on 26 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
In f2fs_sbi_show(), the extension_list, extension_count and hot_ext_count are read without holding sbi->sb_lock. If a concurrent sysfs store modifies the extension list via f2fs_update_extension_list(), the show path may read inconsistent count and array contents, potentially leading to out-of-bounds access or displaying stale data.
Fix this by holding sb_lock around the entire extension list read and format operation.
Weakness: CWE-125
Which versions are affected by CVE-2026-53303?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53303?
Apply the vendor's patch.
Is CVE-2026-53303 being exploited?
There is no known exploitation of CVE-2026-53303 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53303, DEBIAN-CVE-2026-53303, GHSA-rw4v-j63g-mf75, ROOT-OS-DEBIAN-11-CVE-2026-53303, ROOT-OS-DEBIAN-12-CVE-2026-53303, ROOT-OS-UBUNTU-2204-CVE-2026-53303 and 2 more.