CVE-2026-53303
Published Jun 26, 2026
Modified Jun 30, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() In f2fs_sbi_show(), the extension_list, extension_count and hot_ext_count are read without holding sbi->sb_lock. If a concurrent sysfs store modifies the extension list via f2fs_update_extension_list(), the show path may read inconsistent count and array contents, potentially leading to out-of-bounds access or displaying stale data. Fix this by holding sb_lock around the entire extension list read and format operation.
EPSS — Exploit Prediction
0.0017
Probability of exploitation
0.07%
Percentile rank
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
References
Other References
https://git.kernel.org/stable/c/4b3a1bf4c2ffd4c9595d900ead78c9035894a025
https://git.kernel.org/stable/c/5909bedbed38c558bee7cb6758ceedf9bc3a9194
https://git.kernel.org/stable/c/cea15f66b7b68b2c50943a6660e0692c6635e4eb
https://git.kernel.org/stable/c/d0e877810baf613b018fd9747440b9d4d9db1428
https://git.kernel.org/stable/c/d3ff0c121bbaef026df6248ab7ef6f0b068b0647
https://git.kernel.org/stable/c/ea3ab43a1f3cf2c7cecd75c8be1ee99a5e94a92e
Frequently Asked Questions
What is CVE-2026-53303? +
In the Linux kernel, the following vulnerability has been resolved:
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()
In f2fs_sbi_show(), the extension_list, extension_count and
hot_ext_count are read without holding sbi->sb_lock. If a concurrent
sysfs store modifies the extension list via f2fs_update_extension_list(),
the show path may read inconsistent count and array contents, potentially
leading to out-of-bounds access or displaying stale data.
Fix this by holding sb_lock around the entire extension list read
and format operation.
How do I check if I'm vulnerable to CVE-2026-53303? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.