CVE-2024-26869

What it actually does

Race condition in f2fs allows concurrent garbage collection and inplace writes to use stale meta_inode page data, resulting in data corruption when invalidate_mapping_pages fails to evict locked or dirty pages.

Why it matters to the business

Can lead to silent data corruption on f2fs filesystems, potentially causing data loss or application failures in environments using flash storage with Linux kernel.

How an attack unfolds

An attacker with local access triggers concurrent data writes and garbage collection operations that race on meta_inode pages, causing old data to be written to new block addresses instead of updated data.

How to fix it

Update the Linux kernel to a version containing commit c92f2927df860a60ba815d3ee610a944b92a8694 or later.

How to confirm the fix worked

Verify kernel version includes the fix commit and test f2fs operations under load to ensure no data corruption occurs.

Typical attack path

1. Gain local access to system
2. Perform concurrent I/O operations that trigger f2fs GC and inplace writes
3. Exploit race to corrupt filesystem data

How to detect it

Inspect system logs for f2fs garbage collection activity coinciding with write errors and scan for unexpected data inconsistencies in files on f2fs volumes.

What your security team should do

• Apply kernel update to include the referenced commit
• Monitor f2fs filesystems for unexpected corruption or errors post-update
• Perform filesystem integrity checks after patching