CVE-2026-46175 Overview
CVE-2026-46175 is a Linux kernel vulnerability in the Flash-Friendly File System (f2fs) subsystem. The flaw stems from Foreground Garbage Collection (FGGC) failing to clear the dentry and fsync marks during node block migration. As a result, fsck may misinterpret migrated node blocks as user-issued fsync writes, producing filesystem consistency errors.
The issue is documented in the upstream kernel commits resolving the inconsistency. While the impact is limited to filesystem metadata integrity rather than remote exploitation, it can cause fsck --dry-run to report inconsistencies on otherwise healthy filesystems following a sudden power-off (SPO) event.
Critical Impact
fsck reports false filesystem inconsistencies after FGGC operations, potentially triggering unnecessary repair actions on f2fs volumes following unclean shutdowns.
Affected Products
- Linux kernel versions containing the f2fs FGGC node migration code path prior to the upstream fix
- Systems using f2fs as a primary or secondary filesystem
- Distributions tracking the stable kernel branches referenced in commits 8be551f, c3e238b, and e7c6d30
Discovery Timeline
- 2026-05-28 - CVE-2026-46175 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46175
Vulnerability Analysis
The vulnerability resides in the f2fs garbage collection logic responsible for relocating node blocks. During FGGC, the kernel migrates node blocks without clearing the DENT_BIT_SHIFT dentry mark or the fsync mark on the destination block. When the system later experiences a sudden power-off before a checkpoint is written, fsck scans the node area and finds inodes flagged as fsync-written even though they were already checkpointed.
This mismatch causes fsck to incorrectly classify migrated nodes as recovery candidates. The classification triggers false consistency violations and may invoke unnecessary roll-forward recovery on data that does not require it.
The issue is a [Kernel Vulnerability] in filesystem metadata handling. It is distinct from memory corruption and does not directly enable code execution. The integrity impact concerns filesystem state correctness rather than confidentiality.
Root Cause
In Background Garbage Collection (BGGC) mode, node migration is handled by f2fs_sync_node_pages(), which clears the dentry and fsync marks before writing. The FGGC path bypasses this routine and writes node blocks directly without sanitizing the marks. The upstream fix moves the set/clear logic for fsync and dentry marks into __write_node_folio so both BGGC and FGGC paths produce consistent on-disk state.
Attack Vector
The vulnerability is not exploitable for privilege escalation or code execution. Triggering the condition requires local filesystem activity followed by a sudden power-off. The reproduction sequence involves writing inline inodes, syncing, removing files, invoking f2fs_io gc_range to relocate blocks in sync mode without a checkpoint, then forcing power loss. The resulting fsck --dry-run reports stale DENT_BIT_SHIFT flags on checkpointed inodes.
The vulnerability mechanism is described in the patch commits. See the Kernel Git Commit 8be551f, Kernel Git Commit c3e238b, and Kernel Git Commit e7c6d30 for the authoritative fix details.
Detection Methods for CVE-2026-46175
Indicators of Compromise
- fsck.f2fs --dry-run output reporting inodes with DENT_BIT_SHIFT set despite being checkpointed
- Unexpected roll-forward recovery activity in kernel logs after f2fs mount following an unclean shutdown
- Recurring filesystem consistency warnings on systems that frequently invoke f2fs_io gc_range
Detection Strategies
- Audit running kernel versions against the patched stable releases referenced in the upstream commits
- Inspect dmesg output for f2fs recovery messages immediately following mount
- Review system logs for repeated FGGC activity preceding sudden power-off events
Monitoring Recommendations
- Monitor kernel package versions across the Linux fleet to identify unpatched hosts running f2fs
- Track filesystem error counters exposed through /sys/fs/f2fs/<device>/ for anomalous activity
- Alert on unexpected fsck.f2fs runs that report inconsistencies on production systems
How to Mitigate CVE-2026-46175
Immediate Actions Required
- Identify systems running f2fs and confirm the kernel version against the patched stable branches
- Apply distribution kernel updates that incorporate commits 8be551f, c3e238b, and e7c6d30
- Schedule reboots for affected hosts after package installation to load the patched kernel
Patch Information
The fix is available in the upstream Linux kernel stable tree. The corrective commits move the set/clear logic for fsync and dentry marks into __write_node_folio, ensuring FGGC paths clear these marks before writing. Reference the Kernel Git Commit 8be551f, Kernel Git Commit c3e238b, and Kernel Git Commit e7c6d30 for the merged fixes.
Workarounds
- Avoid invoking f2fs_io gc_range in sync mode on production volumes until the patch is applied
- Force a checkpoint with sync after garbage collection operations to reduce the window for fsck misinterpretation
- Where feasible, prefer filesystems other than f2fs on systems prone to sudden power loss until patched
# Verify kernel version contains the f2fs FGGC fix
uname -r
# Check if f2fs is mounted on any volumes
mount | grep f2fs
# Force checkpoint after garbage collection as a temporary workaround
sync && echo 1 > /sys/fs/f2fs/<device>/cp_interval
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
