CVE-2026-43349 Overview
CVE-2026-43349 is a medium-severity vulnerability in the Linux kernel's Flash-Friendly File System (f2fs) implementation. The flaw resides in f2fs_sanity_check_node_footer() within fs/f2fs/node.c, where the kernel accesses uninitialized memory when a folio read from the underlying block device fails. The issue was identified by syzbot through KMSAN instrumentation, which reported an uninit-value access at offset 0x374 in the function. The vulnerability is categorized under [CWE-908: Use of Uninitialized Resource]. A successful trigger leads to kernel-level availability impact on the affected host.
Critical Impact
A local attacker with low privileges can trigger uninitialized memory access in the f2fs read path, causing kernel-level denial of service on systems mounting crafted or faulty f2fs volumes.
Affected Products
- Linux Kernel (mainline linux:linux_kernel)
- Linux Kernel stable branches prior to commits 59970b25, 7b9161a6, and a10b8934
- Distributions shipping unpatched f2fs support
Discovery Timeline
- 2026-05-08 - CVE-2026-43349 published to the National Vulnerability Database (NVD)
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-43349
Vulnerability Analysis
The defect is an uninitialized memory read in the f2fs read completion path. When a block device read into a folio fails, f2fs_finish_read_bio() in fs/f2fs/data.c still allows subsequent processing to reach f2fs_sanity_check_node_footer(). That function then inspects node footer fields backed by a folio whose contents were never populated. KMSAN flagged the access at fs/f2fs/node.c:1520, with the call chain traversing f2fs_read_end_io(), bio_endio(), read_node_folio(), __get_node_folio(), and f2fs_iget() during a mount() syscall. The upstream fix adds an explicit failure check so that footer validation is skipped when the folio data is not valid.
Root Cause
The root cause is missing error-state handling between bio completion and node footer validation. The f2fs read pipeline assumed folio data would be present whenever the sanity check executed. When f2fs_submit_page_bio() returned an I/O failure, the folio remained uninitialized but was still consumed by f2fs_sanity_check_node_footer(). This violates safe initialization assumptions tracked by [CWE-908].
Attack Vector
Exploitation requires local access with low privileges, typically the ability to mount or interact with an f2fs filesystem. An attacker supplies a crafted f2fs image or induces I/O errors on an existing f2fs volume so that node folio reads fail. The resulting uninitialized read can corrupt kernel decision logic and produce a kernel panic or hang, yielding high availability impact with no confidentiality or integrity loss. Network exploitation is not possible, and user interaction is not required.
No verified public exploit code is available. The vulnerability mechanism is documented in the upstream commits referenced below; see the Kernel Git Commit 59970b25 for the fix detail.
Detection Methods for CVE-2026-43349
Indicators of Compromise
- KMSAN or KASAN reports referencing f2fs_sanity_check_node_footer in kernel logs
- Unexpected kernel oops or panic entries originating in fs/f2fs/node.c near line 1520
- Repeated mount failures or I/O error bursts on f2fs-backed block devices
Detection Strategies
- Audit running kernel versions against the patched commits 59970b25, 7b9161a6, and a10b8934 using package inventory tools
- Monitor dmesg and journalctl -k for stack traces involving f2fs_finish_read_bio and f2fs_read_end_io
- Track mount events for f2fs volumes from removable media or user-controlled images
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized log platform for stack-trace correlation
- Alert on syscall sequences combining mount() of f2fs images with subsequent kernel crash signals
- Baseline normal f2fs I/O error rates and flag deviations indicative of crafted image probing
How to Mitigate CVE-2026-43349
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the vendor advisories and reboot affected hosts
- Restrict the ability of unprivileged users to mount arbitrary filesystem images via mount, loop devices, or automount services
- Inventory hosts using f2fs and prioritize patching on multi-tenant or workstation systems where local access is broad
Patch Information
The Linux kernel maintainers resolved the issue by adding a validity check before invoking f2fs_sanity_check_node_footer() on a folio that may have failed to read. Fix commits are available at Kernel Git Commit 59970b25, Kernel Git Commit 7b9161a6, and Kernel Git Commit a10b8934. Apply the stable kernel update provided by your distribution.
Workarounds
- Disable or unload the f2fs kernel module on systems that do not require it: modprobe -r f2fs
- Block automatic mounting of removable media containing f2fs filesystems through udev or polkit policy
- Limit local shell access on systems where kernel updates cannot be applied immediately
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
