VulnerabilityPublished 24 Jun 2026Updated 21 Oct 2026

CVE-2026-53017: Linux kernel · f2fs: fix data loss caused by incorrect use of nat_entry flag

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in cb06a07d835ba1ea250785a796243bb483e65816 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in cb06a07d835ba1ea250785a796243bb483e65816, 0645fa4d48e9b77d93f8b7a1c1fea58a97c2f8b0, 238e14eb7226f883b72caccd2d37bf5707df066b +2

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ e05df3b115e7308afbca652769b54e4549fcc723, < cb06a07d835ba1ea250785a796243bb483e65816	Fixed in cb06a07d835ba1ea250785a796243bb483e65816
LinuxLinux	Affected ≥ e05df3b115e7308afbca652769b54e4549fcc723, < 0645fa4d48e9b77d93f8b7a1c1fea58a97c2f8b0	Fixed in 0645fa4d48e9b77d93f8b7a1c1fea58a97c2f8b0
LinuxLinux	Affected ≥ e05df3b115e7308afbca652769b54e4549fcc723, < 238e14eb7226f883b72caccd2d37bf5707df066b	Fixed in 238e14eb7226f883b72caccd2d37bf5707df066b
LinuxLinux	Affected ≥ e05df3b115e7308afbca652769b54e4549fcc723, < 20cedb4d9f6b230d0ee469690b8f868f06a07c29	Fixed in 20cedb4d9f6b230d0ee469690b8f868f06a07c29
LinuxLinux	Affected ≥ e05df3b115e7308afbca652769b54e4549fcc723, < 9fd3bcb54a6afea5fa8a828d010561143560b7c5	Fixed in 9fd3bcb54a6afea5fa8a828d010561143560b7c5
LinuxLinux	Affected =3.8	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix data loss caused by incorrect use of nat_entry flag Data loss can occur when fsync is performed on a newly created file (before any checkpoint has been written) concurrently with a checkpoint operation. The scenario is as follows: create & write & fsync 'file A' write checkpoint - f2fs_do_sync_file // inline inode - f2fs_write_inode // inode folio is dirty - f2fs_write_checkpoint - f2fs_flush_merged_writes - f2fs_sync_node_pages - f2fs_flush_nat_entries - f2fs_fsync_node_pages // no dirty node - f2fs_need_inode_block_update // return false SPO and lost 'file A' f2fs_flush_nat_entries() sets the IS_CHECKPOINTED and HAS_LAST_FSYNC flags for the nat_entry, but this does not mean that the checkpoint has actually completed successfully. However, f2fs_need_inode_block_update() checks these flags and incorrectly assumes that the checkpoint has finished. The root cause is that the semantics of IS_CHECKPOINTED and HAS_LAST_FSYNC are only guaranteed after the checkpoint write fully completes. This patch modifies f2fs_need_inode_block_update() to acquire the sbi->node_write lock before reading the nat_entry flags, ensuring that once IS_CHECKPOINTED and HAS_LAST_FSYNC are observed to be set, the checkpoint operation has already completed.

References

Community reviews

Loading reviews…