CVE-2026-53018: Linux Kernel F2FS GC Vulnerability

CVE-2026-53018 Overview

CVE-2026-53018 is a Linux kernel vulnerability in the Flash-Friendly File System (f2fs) garbage collection (GC) subsystem. The flaw triggers a VM_BUG_ON_FOLIO(folio_test_uptodate(folio)) assertion when the GC mechanism attempts to read a page that has already been updated by a prior data block move. The result is a kernel BUG at mm/filemap.c:1563, causing a kernel panic and denial of service. The issue was identified during fuzz testing and is similar to a previously reported syzbot finding related to commit 9bf1a3f ("f2fs: avoid GC causing encrypted file corrupted").

Critical Impact
A local attacker capable of triggering specific f2fs garbage collection sequences can crash the kernel through a VM_BUG_ON_FOLIO assertion failure, resulting in denial of service.

Affected Products

Linux kernel with f2fs filesystem support
Stable branches receiving commits 4623c25, 570e2cc, and b663ebb
Systems mounting f2fs volumes with garbage collection enabled

Discovery Timeline

2026-06-24 - CVE-2026-53018 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53018

Vulnerability Analysis

The vulnerability resides in the f2fs garbage collection path, specifically in do_garbage_collect() and the read-ahead logic invoked through ra_data_block(). During GC, a data page can be relocated from one block address to another using move_data_block(). Once written to the new block address, the page is marked uptodate in the page cache.

The defect occurs when the same page is selected for GC a second time. The kernel issues a fresh read I/O against the prior block address even though the corresponding folio in the page cache is already marked uptodate. When f2fs_read_end_io() completes and invokes folio_end_read(), the VM_BUG_ON_FOLIO(folio_test_uptodate(folio)) assertion fires because the folio is being marked uptodate twice.

The call chain leading to the crash includes gc_thread_func → f2fs_gc → do_garbage_collect → pagecache_get_page → I/O submission, with completion through scsi_done → bio_endio → f2fs_read_end_io → folio_end_read. This is a race condition and state-tracking flaw [CWE-362, CWE-665] in kernel filesystem code.

Root Cause

The root cause is the absence of a check for whether a folio is already uptodate before initiating read I/O during GC operations. When a page has been moved by a prior move_data_block call, its cached copy is already valid. Re-reading the page from the old block address produces a duplicate end-I/O completion that violates page cache invariants.

Attack Vector

Exploitation requires the ability to mount or interact with an f2fs filesystem and induce GC activity that triggers the duplicate move sequence. The original report identifies fuzz testing as the discovery method, indicating that crafted filesystem layouts or workloads can reach the vulnerable code path. The impact is a kernel panic, which terminates the host system.

No code example is published with the advisory. The fix is distributed across three upstream kernel commits referenced in the stable kernel git tree.

Detection Methods for CVE-2026-53018

Indicators of Compromise

Kernel panic messages referencing VM_BUG_ON_FOLIO(folio_test_uptodate(folio)) in mm/filemap.c
Stack traces containing f2fs_read_end_io, f2fs_finish_read_bio, and do_garbage_collect
Unexpected reboots or kernel oopses on hosts mounting f2fs volumes
Crash dumps showing the f2fs GC thread (gc_thread_func) in the panic backtrace

Detection Strategies

Monitor /var/log/kern.log, dmesg, and journalctl -k output for f2fs-related BUG assertions
Configure kdump to capture kernel crash dumps for forensic analysis of suspected triggers
Track kernel version inventory against the patched commits 4623c25, 570e2cc, and b663ebb
Correlate filesystem mount events with subsequent kernel instability on f2fs-backed systems

Monitoring Recommendations

Forward kernel logs to a centralized SIEM with alerting on BUG, oops, and panic strings
Track host uptime regressions on Android devices and embedded systems that rely on f2fs
Audit fuzzing or QA workloads that exercise filesystem GC paths in non-production environments

How to Mitigate CVE-2026-53018

Immediate Actions Required

Apply the upstream kernel patches identified by commits 4623c251, 570e2ccc, and b663ebb8 to all f2fs-enabled hosts
Update to a stable Linux kernel release that incorporates these three commits
Restrict local user access to fuzzing tools and filesystem manipulation utilities on production systems
Inventory devices using f2fs (notably Android handsets and embedded Linux) and prioritize their kernel updates

Patch Information

The fix adds a check that skips read I/O during GC when the target folio is already marked uptodate. The patch is available across three commits in the stable kernel tree: Kernel Git Commit 4623c25, Kernel Git Commit 570e2cc, and Kernel Git Commit b663ebb. Distribution kernels should pick up the patches in upcoming security releases.

Workarounds

Where feasible, migrate sensitive workloads off f2fs to a filesystem not affected by this defect until patching is complete
Disable or reduce f2fs background GC activity using sysfs tunables under /sys/fs/f2fs/<device>/gc_* where supported
Limit untrusted local users from mounting attacker-controlled f2fs images

bash

# Verify running kernel and check for the fix
uname -r

# Inspect f2fs GC tunables (replace <dev> with your f2fs block device)
ls /sys/fs/f2fs/<dev>/
cat /sys/fs/f2fs/<dev>/gc_idle

# Reduce GC aggressiveness as a temporary mitigation
echo 1 | sudo tee /sys/fs/f2fs/<dev>/gc_idle