Description
In the Linux kernel, the following vulnerability has been resolved:

f2fs: accurately adjust free_sections during free_segment_range

In free_segment_range(), MAIN_SECS(sbi) is temporarily reduced by `secs`
to restrict block allocation to the safe remaining main area while valid
blocks in the truncated range are evacuated by GC.

However, FREE_I(sbi)->free_sections tracks the total number of free
sections across the whole filesystem. If any sections within the
truncated range were already free upon entering free_segment_range(),
failing to deduct them from free_sections causes the filesystem to
overestimate available free sections in the active, reduced main area.
This leads to inconsistent free section accounting during GC data
migration and can trigger unexpected allocation failures or assertion
errors when space is tight.

Fix this by calculating the number of already-free sections in the
truncated range, deducting them from free_sections upon entering
free_segment_range(), and restoring them on exit.
Published: 2026-09-25
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

A flaw in the F2FS filesystem of the Linux kernel causes the free sections counter to be overestimated when a segment range is freed. The logic that should reduce the counter by the number of already‑free sections in the truncated range fails, leading the kernel to believe more space is available than actually is. If storage is tight, this can force the garbage collector to fail or trigger assertion errors, potentially causing the file system to become unavailable. The weakness is an improper initialization or bookkeeping error (CWE‑665).

Affected Systems

The issue is present in the Linux kernel implementation of the F2FS filesystem. It applies to all distributions that ship the affected kernel version and use F2FS as a storage backend. No specific kernel release numbers are listed in the data; kernel maintainers should check that the latest stable release contains the patch that corrects the free_sections accounting logic.

Risk and Exploitability

The CVSS score is not provided, but the lack of an EPSS score and the absence of a KEV listing suggest that, so far, there is no publicly known exploitation. The flaw is local in nature and requires the ability to manipulate file‑system metadata (for example, by writing to a file that triggers a free_segment_range). An attacker with local or privileged access could use the overflow in the free counter to force allocation failures or crash the file system, leading to denial of service for applications that rely on the affected storage. As the vulnerability is not listed in CISA’s KEV catalog and no exploit probability is reported, the likelihood of immediate exploitation is low, yet the impact warrants prompt remediation.

Generated by OpenCVE AI on September 25, 2026 at 12:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the F2FS free section accounting patch.
  • Reboot the system to load the updated kernel and ensure the new free section logic is active.
  • Run a filesystem check (e.g., f2fsck) on all affected F2FS volumes to confirm integrity after the upgrade.

Generated by OpenCVE AI on September 25, 2026 at 12:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: f2fs: accurately adjust free_sections during free_segment_range In free_segment_range(), MAIN_SECS(sbi) is temporarily reduced by `secs` to restrict block allocation to the safe remaining main area while valid blocks in the truncated range are evacuated by GC. However, FREE_I(sbi)->free_sections tracks the total number of free sections across the whole filesystem. If any sections within the truncated range were already free upon entering free_segment_range(), failing to deduct them from free_sections causes the filesystem to overestimate available free sections in the active, reduced main area. This leads to inconsistent free section accounting during GC data migration and can trigger unexpected allocation failures or assertion errors when space is tight. Fix this by calculating the number of already-free sections in the truncated range, deducting them from free_sections upon entering free_segment_range(), and restoring them on exit.
Title f2fs: accurately adjust free_sections during free_segment_range
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T10:21:33.792Z

Reserved: 2026-09-24T16:01:01.153Z

Link: CVE-2026-97534

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:03.643

Modified: 2026-09-25T11:17:03.643

Link: CVE-2026-97534

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T12:45:17Z

Weaknesses