News › linux
By The Linux Camp News, October 19, 2026
The proposed filesystem uses Reed-Solomon parity to repair corrupted reads without a second copy. Default integrity gaps, crash recovery and limited testing remain important qualifications.
On October 19, 2026, Aurelien DESBRIERES submitted an 18-patch request for comments proposing BeamFS, a Linux filesystem intended to correct corruption on one storage device without another data copy. This is a design submission for review, not an announcement that Linux has gained a supported filesystem. 2 1
The repair information lives alongside the data as Reed-Solomon parity, redundant information used to reconstruct damaged bytes. Each data block contains sixteen interleaved RS(255,239) codewords, which Linux's lib/reed_solomon decodes on every read. The intended result is corrected data or an -EIO input/output error, although the default settings have exceptions described below. Metadata also carries parity. The default layout devotes 288 bytes of each 4096 bytes, roughly 7%, to overhead. 2
The target is single-device equipment operating in radiation-prone environments. For an operator evaluating that use case, the protection boundary matters: BeamFS covers the path from the storage medium to the page cache, not memory corruption after a read completes. It therefore does not replace error-correcting memory. 1 2
Evaluators should establish which integrity features a test volume uses before interpreting a successful read. By default, a corrupted indirect pointer can select another allocated block without detection. Separately, more than eight corrupted bytes in a codeword can make the decoder produce an incorrect correction. The author says DATA_SELFID closes the pointer gap and DATA_CSUM turns the latter case into a refused read. The formatter's --data-csum option enables both, but neither feature is enabled by default. 2
Correcting corrupted bytes is also distinct from recovering a consistent filesystem after a crash. BeamFS has neither a journal nor copy-on-write, and metadata writeback has no guaranteed ordering. An unclean shutdown is left to fsck.beamfs. The operational inference is that successful corruption-repair tests cannot establish safe interrupted-write recovery; that needs separate evaluation. 2
The RFC reports tests of BeamFS 0.1.26, commit 1bf151d, on Linux 7.3-rc5. Of the 734-test xfstests auto group, all 122 tests that ran on x86-64 passed. On aarch64, 122 of 123 passed in the sweep; the remaining test timed out and passed alone. Declined tests, mostly involving unimplemented features, were not counted as passes. These are the submitter's reported results, not independent validation. 2
For corruption testing, the author reports injecting single-bit errors into read I/O with emufi on an aarch64 cluster and USB flash media. BeamFS reportedly returned the correct file in every exercised case except one, where it refused the read after an indirect-pointer corruption. That demonstrates behavior under the exercised faults, rather than a general guarantee that all corrupted reads are corrected or rejected. 2
The reported experiments used emulated faults, not actual irradiation. No decode encountered more than two erroneous symbols per codeword, leaving burst errors, the eight-symbol correction limit and beyond-limit miscorrection untested. Performance was not measured either. Consequently, the 7% storage-overhead figure says nothing about read latency, throughput or CPU cost, all of which remain evaluation gaps. 2