CVE-2026-63812 Overview
CVE-2026-63812 is a vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) implementation. The flaw resides in the __destroy_extent_node() function, which fails to reset the length of the largest extent to zero and update the inode folio after setting the FI_NO_EXTENT inode flag. Because subsequent modifications to the extent tree are disallowed, the cached largest extent becomes stale. This inconsistency triggers a sanity check failure in the extent cache, generating errors during filesystem operations such as those exercised by the xfstests generic/388 test case.
Critical Impact
A local authenticated attacker can leverage the stale extent cache to trigger filesystem corruption conditions, impacting confidentiality, integrity, and availability of data stored on F2FS volumes.
Affected Products
- Linux kernel versions containing commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback")
- Linux distributions shipping affected F2FS kernel modules
- Systems using F2FS as a primary or secondary filesystem
Discovery Timeline
- 2026-07-19 - CVE-2026-63812 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63812
Vulnerability Analysis
The vulnerability manifests in the F2FS extent cache subsystem within the Linux kernel. When __destroy_extent_node() sets the FI_NO_EXTENT inode flag, it fails to zero the length of the largest cached extent and update the corresponding inode folio. Since subsequent extent tree modifications are blocked after this flag is set, the cached extent metadata remains inconsistent with the on-disk state.
The resulting sanity check failure surfaces through kernel log messages such as F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix. This indicates the in-memory extent tracking has diverged from expected values, requiring fsck intervention.
Root Cause
The root cause traces back to commit ed78aeebef05, which introduced a node_cnt zero check within __destroy_extent_node() intended to address a race between extent node destruction and writeback. In the f2fs_drop_inode path, however, this check is unnecessary because concurrent writeback is expected behavior and legitimately updates the extent cache. The patch reverts that earlier commit and removes the unneeded zero check to restore correct extent cache invalidation semantics.
Attack Vector
Exploitation requires local access with low privileges on a system using F2FS. An attacker performing crafted filesystem operations can trigger inode-drop and writeback paths that expose the stale extent cache condition. The vulnerability manifests during normal file operations and does not require user interaction. See the Kernel Commit 1f70ddb and related patches for the resolution path.
Detection Methods for CVE-2026-63812
Indicators of Compromise
- Kernel log entries containing sanity_check_extent_cache errors referencing incorrect extent info on F2FS-mounted volumes
- Repeated run fsck to fix messages tied to F2FS inode extent metadata
- Filesystem corruption warnings appearing after high I/O workloads involving inode drops and writeback
Detection Strategies
- Monitor dmesg and /var/log/kern.log for F2FS sanity check failures referencing extent info discrepancies
- Correlate F2FS error events with running kernel version to identify unpatched systems
- Audit installed kernel packages against the fix commits listed in the upstream references
Monitoring Recommendations
- Aggregate kernel filesystem logs into a centralized logging platform for anomaly detection
- Alert on any occurrence of sanity_check_extent_cache strings in host telemetry
- Track kernel version inventory across Linux endpoints and servers to identify systems missing the F2FS patch
How to Mitigate CVE-2026-63812
Immediate Actions Required
- Apply the upstream kernel patch that reverts commit ed78aeebef05 and removes the erroneous et->node_cnt zero check in __destroy_extent_node()
- Update to a Linux kernel build that includes the fix commits referenced by the stable kernel maintainers
- Reboot affected systems after patching to ensure the corrected F2FS module is loaded
Patch Information
The fix is available in upstream Linux stable kernel commits: Kernel Commit 1f70ddb, Kernel Commit 20190e4, Kernel Commit 58a5deb, Kernel Commit 7e4d8f9, and Kernel Commit edf12cb. Distribution maintainers should incorporate these patches into their kernel package updates.
Workarounds
- Where practical, avoid using F2FS for critical workloads until the patched kernel is deployed
- Run fsck.f2fs on affected volumes when sanity check errors are observed to restore consistency
- Restrict local unprivileged access on systems where F2FS is in use to reduce exposure
# Verify running kernel version and check for F2FS extent cache errors
uname -r
dmesg | grep -i "sanity_check_extent_cache"
# Run F2FS filesystem check on an unmounted volume
sudo umount /dev/<device>
sudo fsck.f2fs -f /dev/<device>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
