CVE-2026-53368

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage

f2fsneeddentrymark() reads natentry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The scenario is as follows:

create & write & fsync 'file A' write checkpoint - f2fsdosyncfile // inline inode - f2fswriteinode // inode folio is dirty - f2fswritecheckpoint - f2fsflushmergedwrites - f2fssyncnodepages - f2fsfsyncnodepages // no dirty node - f2fsneedinodeblockupdate // return true - f2fsfsyncnodepages // inode dirtied - f2fsneeddentrymark //return true - f2fsflushnatentries - f2fswrite_checkpoint end - __writenodefolio // inode with DENTBITSHIFT set SPO, "fsck --dry-run" find inode has already checkpointed but still with DENTBITSHIFT set

The state observed by f2fsneeddentry_mark() can differ from the state observed in __writenodefolio() after acquiring sbi->nodewrite. The root cause is that the semantics of ISCHECKPOINTED and HASFSYNCEDINODE are only guaranteed after the checkpoint write has fully completed.

This patch moves setdentrymark() into _writenodefolio() and protects it with the sbi->nodewrite lock.