F2FS Extent Cache Invalidation Causes Data Integrity Issues

CVE-2026-63812 is a data integrity vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) that occurs when the __destroy_extent_node() function improperly handles extent tree flags. Specifically, when setting the FI_NO_EXTENT flag to prevent future extent tree modifications, the function fails to reset the cached largest extent length to zero and update the inode folio, leaving stale extent metadata in memory. This affects Linux systems using F2FS, particularly those running storage-intensive workloads or using flash-based storage devices. The vulnerability can trigger sanity check failures and filesystem errors, potentially leading to data corruption or denial of service when the stale cache causes inconsistencies between in-memory state and on-disk metadata.

While this CVE currently has no mapped MITRE ATT&CK techniques or CWE classification, practitioners using Casky's extended reasoning capabilities would detect exploitation patterns by analyzing kernel log anomalies, filesystem integrity check failures, and inode state inconsistencies. The vulnerability represents a Resource Hijacking and Data Destruction threat pattern—attackers could trigger repeated extent cache invalidations to exhaust filesystem resources or corrupt file metadata. Casky practitioners would identify the attack through monitoring for repeated "sanity_check_extent_cache" failures, unexpected FI_NO_EXTENT flag transitions, and folio update anomalies that deviate from normal F2FS operational patterns, enabling early detection of filesystem-level exploitation attempts.