CVE-2026-53303 Details
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() In f2fs_sbi_show(), the extension_list, extension_count and hot_ext_count are read without holding sbi->sb_lock. If a concurrent sysfs store modifies the extension list via f2fs_update_extension_list(), the show path may read inconsistent count and array contents, potentially leading to out-of-bounds access or displaying stale data. Fix this by holding sb_lock around the entire extension list read and format operation.
A vulnerability exists in the Linux kernel's handling of the extension list in the F2FS file system. The issue arises because the extension list, along with its counts, is read without proper synchronization, allowing concurrent modifications to create inconsistencies. This could lead to out-of-bounds access or the display of outdated information. The vulnerability affects the Linux kernel stable tree.
The vulnerability has been addressed by modifying the 'f2fs_sbi_show' function to include the necessary locks around the reading of the extension list and its counts, ensuring that concurrent modifications do not lead to inconsistencies.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/4b3a1bf4c2ffd4c9595d900ead78c9035894a025 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5909bedbed38c558bee7cb6758ceedf9bc3a9194 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cea15f66b7b68b2c50943a6660e0692c6635e4eb | kernel.org | Patch |
| https://git.kernel.org/stable/c/d0e877810baf613b018fd9747440b9d4d9db1428 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d3ff0c121bbaef026df6248ab7ef6f0b068b0647 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92e | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.17, < 6.1.175 >= 6.2, < 6.6.141 >= 6.7, < 6.12.91 >= 6.13, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | New CVE Received | kernel.org |