CVE-2026-89832 (GCVE-0-2026-89832)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-21 12:48
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage.
References
Impacted products
Vendor Product Version
Linux Linux Version: b42b179bda9ff11075a6fc2bac4d9e400513679a
Version: b42b179bda9ff11075a6fc2bac4d9e400513679a
Version: b42b179bda9ff11075a6fc2bac4d9e400513679a
Version: b42b179bda9ff11075a6fc2bac4d9e400513679a
Version: b42b179bda9ff11075a6fc2bac4d9e400513679a
Version: 8d7ebdd109b4654ec5e0e9c3c6f08b06d6558f10
Version: b039536485970829918aa237a08417bd0ed5437c
Version: 4.19.51   ≤
Version: 5.1.10   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/node.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21b7f66716b4fd0dffac4fcd06602b888f3c4531",
              "status": "affected",
              "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
              "versionType": "git"
            },
            {
              "lessThan": "34732e3a8713f3b7acd1a0ea37e3a6bee4c78550",
              "status": "affected",
              "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
              "versionType": "git"
            },
            {
              "lessThan": "ab35ae07f2b5b4e118ea47b88577fc7d0e797b17",
              "status": "affected",
              "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
              "versionType": "git"
            },
            {
              "lessThan": "3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2",
              "status": "affected",
              "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
              "versionType": "git"
            },
            {
              "lessThan": "5b86eab84ac8e9289b5afc52ef88ab18ba5bacab",
              "status": "affected",
              "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8d7ebdd109b4654ec5e0e9c3c6f08b06d6558f10",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b039536485970829918aa237a08417bd0ed5437c",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.51",
              "versionType": "semver"
            },
            {
              "lessThan": "5.2",
              "status": "affected",
              "version": "5.1.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/node.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.1.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to clear dirty flag on folio in error path\n\nIf node block is corrupted due to chksum mismatch or inconsistent\nfooter info, it needs to drop clear flag of node folio, in order\nto persist inconsistent node data to storage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - __get_node_folio is reached only through local VFS operations (lookup, open, read/write, fallocate, fsync, GC) on a mounted f2fs volume such as Android userdata or removable flash; it is not a ksmbd/nfsd/packet-processing path.\nAC:L - A crafted f2fs image lets the attacker pick node footers and nids so a dirty direct-node folio is later re-fetched as NODE_TYPE_INODE (or fails checksum) on ordinary file ops; triggering is deterministic with no race or rare config.\nPR:L - After automount (Android vold/udisks2 portable f2fs) or on already-mounted userdata, any unprivileged user with file access reaches __get_node_folio via write then lookup; no CAP_SYS_ADMIN is needed on that syscall path.\nUI:N - The attacker dirties the node and then looks up the type-confused nid themselves; removable f2fs is commonly auto-mounted and scanned without a separate victim mount or open step.\nS:U - Dirty-flag mishandling, persisted node metadata, and any page-cache fallout remain in the host kernel\u0027s authority; this is not a VM escape, container breakout, or IOMMU bypass.\nC:H - A still-dirty corrupted node folio can be written back with inconsistent mappings, and a later read_node_folio will read into that dirty folio; file offsets can then resolve to other files\u0027 or leftover blocks and disclose their contents.\nI:H - Writeback of the leftover dirty node persists inconsistent footer/checksum metadata, and the subsequent read into a dirty folio overwrites in-memory node contents from disk, corrupting block maps in an attacker-influenced way.\nA:H - Footer failure on a still-dirty node stops checkpoint (and panics with errors=panic), can leak F2FS_DIRTY_NODES so checkpoint retries hang, and dirty !uptodate node folios can oops or freeze filesystem I/O."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:48:55.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21b7f66716b4fd0dffac4fcd06602b888f3c4531"
        },
        {
          "url": "https://git.kernel.org/stable/c/34732e3a8713f3b7acd1a0ea37e3a6bee4c78550"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab35ae07f2b5b4e118ea47b88577fc7d0e797b17"
        },
        {
          "url": "https://git.kernel.org/stable/c/3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b86eab84ac8e9289b5afc52ef88ab18ba5bacab"
        }
      ],
      "title": "f2fs: fix to clear dirty flag on folio in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89832",
    "datePublished": "2026-09-16T10:31:04.691Z",
    "dateReserved": "2026-09-11T19:38:34.769Z",
    "dateUpdated": "2026-10-21T12:48:55.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.