CVE-2026-46175: f2fs: fix fsck inconsistency caused by FGGC of node block

Synopsis

A filesystem state corruption flaw exists in the Linux kernel's f2fs (Flash-Friendly File System) driver. A local attacker with low-privilege access can trigger Foreground Garbage Collection (FGGC) of node blocks without clearing fsync and dentry marks, causing fsck to misinterpret migrated node blocks as user-issued fsync writes, which corrupts filesystem metadata consistency. Successful exploitation allows an attacker to tamper with filesystem integrity and crash the affected filesystem, leading to data tampering and denial of service. A patched-image rebuild is available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attack vector is local (AV:L), so the attacker needs an existing shell or process on the host; no network access is required.

• AuthenticationRequired

  The attacker must hold a low-privilege account on the target system; any standard user credential is sufficient (PR:L).

• Victim interactionNot required

  No victim interaction is required; the attacker can trigger the vulnerable code path entirely on their own (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, memory layout randomization, or other environmental factors.

Blast Radius

• The attacker corrupts f2fs filesystem metadata by causing fsck to misinterpret migrated node blocks, resulting in persistent filesystem inconsistency.
• Tampered dentry and fsync marks in node blocks can cause subsequent filesystem checks and recovery operations to make incorrect decisions, potentially destroying directory entries or file data references.
• The corrupted filesystem state can render the f2fs volume unmountable or trigger kernel-level errors that crash the filesystem layer, disrupting all services dependent on that volume.