CVE-2026-63816

In the Linux kernel, the following vulnerability has been resolved:

f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode

- ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink

- f2fs_gc

- gc_data_segment

- ra_data_block(cow_inode)

- mapping = F2FS_I(inode)->atomic_inode->i_mapping

: f2fs_is_cow_file(cow_inode) is true

- f2fs_evict_inode(atomic_inode)

- clear_inode_flag(fi->cow_inode, FI_COW_FILE)

- F2FS_I(fi->cow_inode)->atomic_inode = NULL

...

- truncate_inode_pages_final(atomic_inode)

- f2fs_grab_cache_folio(mapping)

: create folio in atomic_inode->mapping

- clear_inode(atomic_inode)

- BUG_ON(atomic_inode->i_data.nrpages)

We need to add a reference on fi->atomic_inode before using its mapping

field during garbage collection, otherwise, it will cause UAF issue.