---
id: CVE-2024-56692
title: 'f2fs: fix to do sanity check on node blkaddr in truncate_node()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  f2fs: fix to do sanity check on node blkaddr in truncate_node()

  syzbot reports a f2fs bug as below:

  ------------[ cut here ]------------
  kernel BUG at fs/f2fs/segment…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 <
    a6d51de6bf729edc9fc7f87ffaae4e6bbda6329a
  - >-
    Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 <
    27d6e7eff07f8cce8e83b162d8f21a07458c860d
  - >-
    Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 <
    c1077078ce4589b5e5387f6b0aaa0d4534b9eb57
  - >-
    Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 <
    0a5c8b3fbf6200f1c66062d307c9a52084917788
  - >-
    Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 <
    6babe00ccd34fc65b78ef8b99754e32b4385f23d
  - Linux 3.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-01T19:59:11.953057Z'
published: '2024-12-28'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:20:25.681Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-56692'
references:
  - url: 'https://git.kernel.org/stable/c/a6d51de6bf729edc9fc7f87ffaae4e6bbda6329a'
  - url: 'https://git.kernel.org/stable/c/27d6e7eff07f8cce8e83b162d8f21a07458c860d'
  - url: 'https://git.kernel.org/stable/c/c1077078ce4589b5e5387f6b0aaa0d4534b9eb57'
  - url: 'https://git.kernel.org/stable/c/0a5c8b3fbf6200f1c66062d307c9a52084917788'
  - url: 'https://git.kernel.org/stable/c/6babe00ccd34fc65b78ef8b99754e32b4385f23d'
tags:
  - cve.org
epss: 0.00215
epssPercentile: 0.1198
ingestedAt: '2026-11-03T15:48:07.690Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on node blkaddr in truncate_node()

syzbot reports a f2fs bug as below:

------------[ cut here ]------------
kernel BUG at fs/f2fs/segment.c:2534!
RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534
Call Trace:
 truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909
 f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288
 f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856
 evict+0x4e8/0x9b0 fs/inode.c:723
 f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986
 f2fs_create+0x357/0x530 fs/f2fs/namei.c:394
 lookup_open fs/namei.c:3595 [inline]
 open_last_lookups fs/namei.c:3694 [inline]
 path_openat+0x1c03/0x3590 fs/namei.c:3930
 do_filp_open+0x235/0x490 fs/namei.c:3960
 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415
 do_sys_open fs/open.c:1430 [inline]
 __do_sys_openat fs/open.c:1446 [inline]
 __se_sys_openat fs/open.c:1441 [inline]
 __x64_sys_openat+0x247/0x2a0 fs/open.c:1441
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534

The root cause is: on a fuzzed image, blkaddr in nat entry may be
corrupted, then it will cause system panic when using it in
f2fs_invalidate_blocks(), to avoid this, let's add sanity check on
nat blkaddr in truncate_node().

## Affected

- `Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < a6d51de6bf729edc9fc7f87ffaae4e6bbda6329a`
- `Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 27d6e7eff07f8cce8e83b162d8f21a07458c860d`
- `Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < c1077078ce4589b5e5387f6b0aaa0d4534b9eb57`
- `Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 0a5c8b3fbf6200f1c66062d307c9a52084917788`
- `Linux >= 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 6babe00ccd34fc65b78ef8b99754e32b4385f23d`
- `Linux 3.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.