CVE-2026-97534 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
f2fs: accurately adjust free_sections during free_segment_range
In free_segment_range(), MAIN_SECS(sbi) is temporarily reduced by `secs` to restrict block allocation to the safe remaining main area while valid blocks in the truncated range are evacuated by GC.
However, FREE_I(sbi)->free_sections tracks the total number of free sections across the whole filesystem. If any sections within the truncated range were already free upon entering free_segment_range(), failing to deduct them from free_sections causes the filesystem to overestimate available free sections in the active, reduced main area. This leads to inconsistent free section accounting during GC data migration and can trigger unexpected allocation failures or assertion errors when space is tight.
Fix this by calculating the number of already-free sections in the truncated range, deducting them from free_sections upon entering free_segment_range(), and restoring them on exit.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The f2fs filesystem implementation within the Linux kernel contains a logic error in the free_segment_range function that results in inaccurate accounting of available storage space during garbage collection operations. This vulnerability stems from an inconsistency between how the total number of free sections is tracked globally versus how it is managed locally when restricting block allocation to a safe remaining main area. Specifically, while MAIN_SECS is temporarily reduced to limit allocations to valid blocks being evacuated by the garbage collector, the global counter for free sections remains unchanged even if some sections within the truncated range were already free before the operation began. This oversight causes the filesystem to overestimate the amount of usable space available in the active main area during critical data migration phases.
The technical flaw lies in the failure to deduct pre-existing free sections from the local free_sections counter when entering the restricted allocation scope. When f2fs performs garbage collection, it must ensure that block allocations do not interfere with blocks currently being moved or invalidated. By temporarily reducing the perceived size of the main section area, the kernel intends to create a safe boundary for new writes. However, because the accounting logic does not subtract sections that are already free within this newly defined boundary, the system believes there is more contiguous space available than actually exists in the context of the restricted allocation window. This discrepancy leads to inconsistent state tracking where the filesystem thinks it can allocate blocks in areas that should be considered unavailable or reserved for garbage collection processes.
The operational impact of this vulnerability includes unexpected allocation failures and potential assertion errors when disk space is tight. During periods of high storage pressure, f2fs relies on accurate free section counts to make decisions about whether new data can be written without triggering immediate full filesystem scans or compaction events. If the system overestimates available space due to this accounting error, it may attempt allocations that exceed actual physical limits within the restricted zone. This mismatch can cause write operations to fail unexpectedly, potentially leading to application errors or file corruption if not handled gracefully by higher-level software layers. In severe cases, particularly when internal consistency checks are enabled, these inconsistencies trigger kernel assertions, which can result in system crashes or panics during heavy I/O workloads involving frequent truncations and garbage collection cycles.
This issue aligns with CWE-20 Improper Input Validation as it involves a failure to correctly process the state of existing free blocks before applying logical constraints on allocation ranges. It also relates to CWE-682 Incorrect Calculation, specifically regarding resource management errors where counters are not updated accurately relative to scope changes. From an ATT&CK perspective, while this is primarily a stability and reliability issue rather than a direct exploitation vector for privilege escalation or data exfiltration, it represents a Denial of Service potential through resource exhaustion logic flaws that could be triggered by specific file manipulation patterns designed to maximize garbage collection activity on nearly full volumes.
Mitigation strategies involve applying the upstream kernel patch that corrects this accounting logic. The fix requires modifying free_segment_range to calculate the number of sections already marked as free within the truncated range and deducting them from the local free_sections counter before proceeding with allocation restrictions. It is equally important to restore these counts upon exit to maintain global consistency across filesystem operations. System administrators should ensure their Linux kernels are updated to versions containing this specific f2fs correction, particularly if they rely on f2fs for critical storage workloads involving frequent file truncations and limited free space scenarios. Regular monitoring of system logs for allocation failures or assertion errors can help identify instances where this bug might have manifested in older kernel versions prior to the patch application.