Linux Kernel: f2fs ExtensionList read w/o sb_lock -> OOB/INCONSISTENT
CVE-2026-53303 Published on June 26, 2026
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
In f2fs_sbi_show(), the extension_list, extension_count and
hot_ext_count are read without holding sbi->sb_lock. If a concurrent
sysfs store modifies the extension list via f2fs_update_extension_list(),
the show path may read inconsistent count and array contents, potentially
leading to out-of-bounds access or displaying stale data.
Fix this by holding sb_lock around the entire extension list read
and format operation.
Products Associated with CVE-2026-53303
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version b6a06cbbb5f7fd03589cff9178314af04c568826 and below d3ff0c121bbaef026df6248ab7ef6f0b068b0647 is affected.
- Version b6a06cbbb5f7fd03589cff9178314af04c568826 and below cea15f66b7b68b2c50943a6660e0692c6635e4eb is affected.
- Version b6a06cbbb5f7fd03589cff9178314af04c568826 and below 4b3a1bf4c2ffd4c9595d900ead78c9035894a025 is affected.
- Version b6a06cbbb5f7fd03589cff9178314af04c568826 and below d0e877810baf613b018fd9747440b9d4d9db1428 is affected.
- Version b6a06cbbb5f7fd03589cff9178314af04c568826 and below ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92e is affected.
- Version b6a06cbbb5f7fd03589cff9178314af04c568826 and below 5909bedbed38c558bee7cb6758ceedf9bc3a9194 is affected.
- Version 4.17 is affected.
- Before 4.17 is unaffected.
- Version 6.1.175, <= 6.1.* is unaffected.
- Version 6.6.141, <= 6.6.* is unaffected.
- Version 6.12.91, <= 6.12.* is unaffected.
- Version 6.18.33, <= 6.18.* is unaffected.
- Version 7.0.10, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.