CVE-2026-93235
UnknownSummary
A flaw was found in the Linux kernel F2FS filesystem where extending a file size across an unaligned EOF boundary did not zero out post-EOF data in the partial page. As a result, stale disk data beyond the previous EOF could be exposed after remounting or crash recovery.
Risk Assessment
Stale on-disk data beyond the previous EOF may leak into file contents visible to users, posing a confidentiality risk. This mainly affects environments other than Android, where direct PBA writes are restricted to pinfile.
Recommendation
Update the Linux kernel to a version containing the fix, and mount F2FS with the fsync_mode=strict option in environments exposed to this issue.
Other vulnerabilities in Linux kernel F2FS
See all- CVE-2026-89830Unknown
In the Linux kernel, __allocate_data_block() in the f2fs filesystem increments the valid block count via inc_valid_block_count() when allocating a new data block, but if the subsequent f2fs_allocate_data_block() fails, the function returns the error without rolling back that increment. This causes a permanent valid block count leak.
- CVE-2026-89829High
In the Linux kernel, f2fs_sanity_check_node_footer() is not passed the correct folio->index value, causing it to check the same nid incorrectly. This can lead to improper node consistency verification in the f2fs filesystem.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch (see /share/git/fstests/results//generic/794.out.bad) --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++ /share/git/fstests/results//generic/794.out.bad 2026-07-05 18:32:55.000000000 +0800 @@ -1,4 +1,16 @@ QA output created by 794 append_write +FAIL: non-zero data in gap [4080,4096) after shutdown+remount +000000 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a >ZZZZZZZZZZZZZZZZ< +* +001000 truncate_up ... (Run 'diff -u /share/git/fstests/tests/generic/794.out /share/git/fstests/results//generic/794.out.bad' to see the entire diff) Ran: generic/794 Failures: generic/794 Failed 1 of 1 tests Steps of generic/794: 1. write 4096 bytes to file w/ 0x5a 2. use fiemap to get PBA of first block in file 3. truncate file to 4080 4. umount; write 4096 bytes to file w/ 0x5a directly via PBA; mount 5. extend filesize via a) append 4096 from offset 4096, or b) truncate 8192, or c) fallocate 4096 from offset 4096 6. verify the gap is zeroed in memory [4080,4096) 7. sync range 4096 from offset 4096; shutdown -f (flush meta before shutdown) 8. umount; mount; verify [4080,4096) is zeroed or not. When extending file size (e.g. via truncate, fallocate, or write) across an unaligned EOF boundary, we need to ensure that post-EOF data in the partial page is zeroed out in pagecache and marked dirty, then writeback the cache to persist zeroed data before committing inode w/ updated i_size. This help to prevent stale disk data beyond the previous EOF from being exposed after remounting or crash recovery. Since f2fs is a LFS filesystem, we only support direct write via PBA in pinfile, and pinfile has section-aligned filesize, so in Android, there should no problem, but for other usage in different environment, let's fix this w/ fsync_mode=strict mount option.