# CVE-2026-53017: f2fs: fix data loss caused by incorrect use of nat_entry flag

CVE-2026-53017 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-53017, released June 25, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-53017
- Priority: Urgent
- CVSS: 9.8 (Critical)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 24, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53017

## Description

In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix data loss caused by incorrect use of nat_entry flag  Data loss can occur when fsync is performed on a newly created file (before any checkpoint has been written) concurrently with a checkpoint operation. The scenario is as follows:  create & write & fsync 'file A'                 write checkpoint - f2fs_do_sync_file // inline inode  - f2fs_write_inode // inode folio is dirty                                                 - f2fs_write_checkpoint                                                  - f2fs_flush_merged_writes                                                  - f2fs_sync_node_pages                                                  - f2fs_flush_nat_entries  - f2fs_fsync_node_pages // no dirty node  - f2fs_need_inode_block_update // return false  SPO and lost 'file A'  f2fs_flush_nat_entries() sets the IS_CHECKPOINTED and HAS_LAST_FSYNC flags for the nat_entry, but this does not mean that the checkpoint has actually completed successfully. However, f2fs_need_inode_block_update() checks these flags and incorrectly assumes that the checkpoint has finished.  The root cause is that the semantics of IS_CHECKPOINTED and HAS_LAST_FSYNC are only guaranteed after the checkpoint write fully completes.  This patch modifies f2fs_need_inode_block_update() to acquire the sbi->node_write lock before reading the nat_entry flags, ensuring that once IS_CHECKPOINTED and HAS_LAST_FSYNC are observed to be set, the checkpoint operation has already completed.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-53017](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53017.md) | Jun 25, 2026 |
| Linux | linux Debian 14 | 7.0.10-1 | [DEBIAN-CVE-2026-53017](https://patchblox.com/security/data/fix/linux/debian-cve-2026-53017.md) | Jun 25, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.