CVE-2026-53368 f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
A race condition in the Linux kernel f2fs filesystem can cause inconsistent inode marking, leading to filesystem check errors and potential data integrity issues.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53368?
CVE-2026-53368 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage
f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The scenario is as follows:
create & write & fsync 'file A' write checkpoint - f2fs_do_sync_file // inline inode - f2fs_write_inode // inode folio is dirty - f2fs_write_checkpoint - f2fs_flush_merged_writes - f2fs_sync_node_pages - f2fs_fsync_node_pages // no dirty node - f2fs_need_inode_block_update // return true - f2fs_fsync_node_pages // inode dirtied - f2fs_need_dentry_mark //return true - f2fs_flush_nat_entries - f2fs_write_checkpoint end - __write_node_folio // inode with DENT_BIT_SHIFT set SPO, "fsck --dry-run" find inode has already checkpointed but still with DENT_BIT_SHIFT set
The state observed by f2fs_need_dentry_mark() can differ from the state observed in __write_node_folio() after acquiring sbi->node_write. The root cause is that the semantics of IS_CHECKPOINTED and HAS_FSYNCED_INODE are only guaranteed after the checkpoint write has fully completed.
This patch moves set_dentry_mark() into __write_node_folio() and protects it with the sbi->node_write lock.
Which versions are affected by CVE-2026-53368?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53368?
Apply the vendor's patch.
Is CVE-2026-53368 being exploited?
There is no known exploitation of CVE-2026-53368 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53368, DEBIAN-CVE-2026-53368, GHSA-7cj6-gq26-374h, ROOT-OS-DEBIAN-11-CVE-2026-53368, ROOT-OS-DEBIAN-12-CVE-2026-53368, ROOT-OS-DEBIAN-13-CVE-2026-53368 and 2 more.