CVE-2026-93235
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to zero post-EOF data when extending file size
Steps of generic/794: 1. write 4096 bytes to file w/ 0x5a 2. use fiemap to get PBA of first block in file 3. truncate file to 4080 4. umount; write 4096 bytes to file w/ 0x5a directly via PBA; mount 5. extend filesize via a) append 4096 from offset 4096, or b) truncate 8192, or c) fallocate 4096 from offset 4096 6. verify the gap is zeroed in memory [4080,4096) 7. sync range 4096 from offset 4096; shutdown -f (flush meta before shutdown) 8. umount; mount; verify [4080,4096) is zeroed or not.
Leer descripción completaMostrar menos
When extending file size (e.g. via truncate, fallocate, or write) across an unaligned EOF boundary, we need to ensure that post-EOF data in the partial page is zeroed out in pagecache and marked dirty, then writeback the cache to persist zeroed data before committing inode w/ updated i_size.
This help to prevent stale disk data beyond the previous EOF from being exposed after remounting or crash recovery.
Since f2fs is a LFS filesystem, we only support direct write via PBA in pinfile, and pinfile has section-aligned filesize, so in Android, there should no problem, but for other usage in different environment, let's fix this w/ fsync_mode=strict mount option.
Detalles técnicos trazas, registros y código del informe original
generic/794 4s ... - output mismatch (see /share/git/fstests/results//generic/794.out.bad)
--- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800
+++ /share/git/fstests/results//generic/794.out.bad 2026-07-05 18:32:55.000000000 +0800
@@ -1,4 +1,16 @@
QA output created by 794
append_write
+FAIL: non-zero data in gap [4080,4096) after shutdown+remount
+000000 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a >ZZZZZZZZZZZZZZZZ<
+*
+001000
truncate_up
...
(Run 'diff -u /share/git/fstests/tests/generic/794.out /share/git/fstests/results//generic/794.out.bad' to see the entire diff)
Ran: generic/794
Failures: generic/794
Failed 1 of 1 testsCVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/32c7f11a24268ba8d3bb50ea7f54d33f698cd253
- https://git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcb
- https://git.kernel.org/stable/c/6882d458d2e403f6ba7b45542dd31a6b7531eb2e
- https://git.kernel.org/stable/c/91ec55ddc097ccddd25ffb95a3d079b2ef362372
- https://git.kernel.org/stable/c/c42608c09b6b5d5967bf211c255914c068c2cde1
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-93235",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a",
"lessThan": "6882d458d2e403f6ba7b45542dd31a6b7531eb2e",
"versionType": "git"
},
{
"status": "affected",
"version": "fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a",
"lessThan": "32c7f11a24268ba8d3bb50ea7f54d33f698cd253",
"versionType": "git"
},
{
"status": "affected",
"version": "fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a",
"lessThan": "91ec55ddc097ccddd25ffb95a3d079b2ef362372",
"versionType": "git"
},
{
"status": "affected",
"version": "fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a",
"lessThan": "c42608c09b6b5d5967bf211c255914c068c2cde1",
"versionType": "git"
},
{
"status": "affected",
"version": "fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a",
"lessThan": "5eced87b7d19dbc76ebdddaf322046f9ac582fcb",
"versionType": "git"
}
],
"programFiles": [
"fs/f2fs/file.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.8",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/f2fs/file.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-24T16:17:19.150",
"references": [
{
"url": "https://git.kernel.org/stable/c/32c7f11a24268ba8d3bb50ea7f54d33f698cd253",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6882d458d2e403f6ba7b45542dd31a6b7531eb2e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/91ec55ddc097ccddd25ffb95a3d079b2ef362372",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c42608c09b6b5d5967bf211c255914c068c2cde1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to zero post-EOF data when extending file size\n\ngeneric/794 4s ... - output mismatch (see /share/git/fstests/results//generic/794.out.bad)\n --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800\n +++ /share/git/fstests/results//generic/794.out.bad 2026-07-05 18:32:55.000000000 +0800\n @@ -1,4 +1,16 @@\n QA output created by 794\n append_write\n +FAIL: non-zero data in gap [4080,4096) after shutdown+remount\n +000000 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a >ZZZZZZZZZZZZZZZZ<\n +*\n +001000\n truncate_up\n ...\n (Run 'diff -u /share/git/fstests/tests/generic/794.out /share/git/fstests/results//generic/794.out.bad' to see the entire diff)\nRan: generic/794\nFailures: generic/794\nFailed 1 of 1 tests\n\nSteps of generic/794:\n1. write 4096 bytes to file w/ 0x5a\n2. use fiemap to get PBA of first block in file\n3. truncate file to 4080\n4. umount; write 4096 bytes to file w/ 0x5a directly via PBA; mount\n5. extend filesize via\n a) append 4096 from offset 4096, or\n b) truncate 8192, or\n c) fallocate 4096 from offset 4096\n6. verify the gap is zeroed in memory [4080,4096)\n7. sync range 4096 from offset 4096; shutdown -f (flush meta before shutdown)\n8. umount; mount; verify [4080,4096) is zeroed or not.\n\nWhen extending file size (e.g. via truncate, fallocate, or write) across an\nunaligned EOF boundary, we need to ensure that post-EOF data in the partial\npage is zeroed out in pagecache and marked dirty, then writeback the cache to\npersist zeroed data before committing inode w/ updated i_size.\n\nThis help to prevent stale disk data beyond the previous EOF from being exposed\nafter remounting or crash recovery.\n\nSince f2fs is a LFS filesystem, we only support direct write via PBA in pinfile,\nand pinfile has section-aligned filesize, so in Android, there should no problem,\nbut for other usage in different environment, let's fix this w/ fsync_mode=strict\nmount option."
}
],
"lastModified": "2026-09-25T13:17:17.770",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}