CVE-2026-63813

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"<br /> <br /> This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598.<br /> <br /> The kernel panics are keeping to be reported especially when the f2fs<br /> partition get almost full. By investigation, we find that the reason is<br /> one f2fs page got freed to buddy without being deleted from LRU and the<br /> root cause is the race happened in [2] which is enrolled by this commit.<br /> <br /> There are 3 race processes in this scenario, please find below for their<br /> main activities.<br /> <br /> The changed code in move_data_block() lets the GC path evict the tail-end<br /> folio from the page cache through folio_end_dropbehind(). Once<br /> folio_unmap_invalidate() removes the folio from mapping-&gt;i_pages, the<br /> page-cache references for all pages in the folio are dropped. The folio<br /> is then kept alive only by temporary external references, which allows a<br /> later split to operate on a folio whose subpages are no longer protected<br /> by page-cache references.<br /> <br /> After the page-cache references are gone, split_folio_to_order() can<br /> split the big folio into individual pages and put the resulting subpages<br /> back on the LRU. For tail pages beyond EOF, split removes them from the<br /> page cache and drops their page-cache references. A tail page can then<br /> remain on the LRU with PG_lru set while holding only the split caller&amp;#39;s<br /> temporary reference. When free_folio_and_swap_cache() drops that final<br /> reference, the page enters the final folio_put() release path.<br /> <br /> In parallel, folio_isolate_lru() can observe the same tail page with a<br /> non-zero refcount and PG_lru set. It clears PG_lru before taking its own<br /> reference. If this races with the final folio_put() from the split path,<br /> __folio_put() sees PG_lru already cleared and skips lruvec_del_folio().<br /> The page is then freed back to the allocator while its lru links are<br /> still present in the LRU list. A later LRU operation on a neighboring<br /> page detects the stale link and reports list corruption.<br /> <br /> [1]<br /> [ 22.486082] list_del corruption. next-&gt;prev should be fffffffec10e0ac8, but was dead000000000122. (next=fffffffec10e0a88)<br /> [ 22.486130] ------------[ cut here ]------------<br /> [ 22.486134] kernel BUG at lib/list_debug.c:67!<br /> [ 22.486141] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP<br /> [ 22.488502] Tainted: [W]=WARN, [O]=OOT_MODULE<br /> [ 22.488506] Hardware name: Spreadtrum UMS9230 1H10 SoC (DT)<br /> [ 22.488511] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 22.488517] pc : __list_del_entry_valid_or_report+0x14c/0x154<br /> [ 22.488531] lr : __list_del_entry_valid_or_report+0x14c/0x154<br /> [ 22.488539] sp : ffffffc08006b830<br /> [ 22.488542] x29: ffffffc08006b868 x28: 0000000000003020 x27: 0000000000000000<br /> [ 22.488553] x26: 0000000000000000 x25: 0000000000000004 x24: fffffffec10e0ac0<br /> [ 22.488564] x23: 00000000000000e8 x22: 0000000000000024 x21: dead000000000122<br /> [ 22.488574] x20: fffffffec10e0a88 x19: fffffffec10e0ac8 x18: ffffffc080061060<br /> [ 22.488585] x17: 20747562202c3863 x16: 6130653031636566 x15: 0000000000000058<br /> [ 22.488595] x14: 0000000000000004 x13: ffffff80f91e0000 x12: 0000000000000003<br /> [ 22.488605] x11: 0000000000000003 x10: 0000000000000001 x9 : ffe85721f0e25f00<br /> [ 22.488615] x8 : ffe85721f0e25f00 x7 : 0000000000000000 x6 : 6c65645f7473696c<br /> [ 22.488625] x5 : ffffffed39b23026 x4 : 0000000000000000 x3 : 0000000000000010<br /> [ 22.488636] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000006d<br /> [ 22.488647] Call trace:<br /> [ 22.488651] __list_del_entry_valid_or_report+0x14c/0x154 (P)<br /> [ 22.488661] __folio_put+0x2bc/0x434<br /> [ 22.488670] folio_put+0x28/0x58<br /> [ 22.488678] do_garbage_collect+0x1a34/0x2584<br /> [ 22.488689] f2fs_gc+0x230/0x9b4<br /> [ 22.488697] f2fs_fallocate+0xb90/0xdf4<br /> [ 22.488706] vfs_fallocate+0x1b4/0x2bc<br /> [ 22.488716] __arm64_sys_fallocate+0x44/0x78<br /> [ 22.488725] invoke_syscall+0x58/0xe4<br /> [ 22.488732] do_el0_svc+0x48/0xdc<br /> [ 22.488739] el0<br /> ---truncated---