CVE-2024-26869

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable paths are entered through ordinary local file operations on a mounted f2fs volume — buffered overwrite with IPU, fdatasync, or O_DIRECT write — with the racing side driven by the in-kernel GC thread. No network or physical access is involved.

AC:LAttack complexity, low

The attacker controls the write side outright and can drive the GC side at will by fragmenting/filling the filesystem to keep background and foreground GC continuously active; the invalidation failure window is the full duration of GC's read bio, during which ra_data_block() holds the meta page locked, so the skip is the expected outcome rather than a narrow accident, and the attempt can be repeated indefinitely.

PR:LPrivileges required, low

Any unprivileged local user with write access to a file on an f2fs volume can reach both f2fs_inplace_write_data() and the F2FS_GET_BLOCK_DIO path; the CAP_SYS_ADMIN check on f2fs_ioc_gc() is not a barrier because the default background GC thread and f2fs_balance_fs()-triggered foreground GC provide the racing side without any privilege.

UI:NUser interaction, none

The attacker's own process performs the writes and the GC thread runs automatically as a kernel thread; no victim action of any kind is required.

S:UScope, unchanged

The corruption is confined to the f2fs filesystem and kernel managing it, with no crossing into a different security authority such as a hypervisor or IOMMU domain.

C:HConfidentiality impact, high

META_MAPPING is a global cache keyed by physical block address, and f2fs_invalidate_blocks() can likewise fail to evict, so a stale page can outlive the block's reallocation to a different inode — move_data_block() then copies the previous owner's on-disk content into the attacker's file, disclosing another user's data (plaintext for verity/compressed inodes).

I:HIntegrity impact, high

This is a direct, silent, persistent on-disk data corruption primitive: freshly written data is overwritten with stale contents, and via physical-block reuse an attacker's stale data can be written into another inode's blocks, modifying data outside the attacker's control with no error reported.

A:HAvailability impact, high

Corrupted blocks landing in compressed clusters or encrypted directory/dentry blocks produce decompression and directory-parse failures that raise EFSCORRUPTED, set SBI_NEED_FSCK, and trigger f2fs_handle_error() shutdown (panic under errors=panic or CONFIG_F2FS_CHECK_FS), alongside irrecoverable loss of the corrupted file data.