CVE-2026-89832 (GCVE-0-2026-89832)

Vulnerability from cvelistv5 – Published: 2026-09-16 10:31 – Updated: 2026-09-16 14:39
VLAI
Title
f2fs: fix to clear dirty flag on folio in error path
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b42b179bda9ff11075a6fc2bac4d9e400513679a , < ab35ae07f2b5b4e118ea47b88577fc7d0e797b17 (git)
Affected: b42b179bda9ff11075a6fc2bac4d9e400513679a , < 3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2 (git)
Affected: b42b179bda9ff11075a6fc2bac4d9e400513679a , < 5b86eab84ac8e9289b5afc52ef88ab18ba5bacab (git)
Affected: 8d7ebdd109b4654ec5e0e9c3c6f08b06d6558f10 (git)
Affected: b039536485970829918aa237a08417bd0ed5437c (git)
Affected: 4.19.51 , < 4.20 (semver)
Affected: 5.1.10 , < 5.2 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.5 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/node.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ab35ae07f2b5b4e118ea47b88577fc7d0e797b17",
              "status": "affected",
              "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
              "versionType": "git"
            },
            {
              "lessThan": "3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2",
              "status": "affected",
              "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
              "versionType": "git"
            },
            {
              "lessThan": "5b86eab84ac8e9289b5afc52ef88ab18ba5bacab",
              "status": "affected",
              "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8d7ebdd109b4654ec5e0e9c3c6f08b06d6558f10",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b039536485970829918aa237a08417bd0ed5437c",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.51",
              "versionType": "semver"
            },
            {
              "lessThan": "5.2",
              "status": "affected",
              "version": "5.1.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/node.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.1.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to clear dirty flag on folio in error path\n\nIf node block is corrupted due to chksum mismatch or inconsistent\nfooter info, it needs to drop clear flag of node folio, in order\nto persist inconsistent node data to storage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - __get_node_folio is reached only through local VFS operations (lookup, open, read/write, fallocate, fsync, GC) on a mounted f2fs volume such as Android userdata or removable flash; it is not a ksmbd/nfsd/packet-processing path.\nAC:L - A crafted f2fs image lets the attacker pick node footers and nids so a dirty direct-node folio is later re-fetched as NODE_TYPE_INODE (or fails checksum) on ordinary file ops; triggering is deterministic with no race or rare config.\nPR:L - After automount (Android vold/udisks2 portable f2fs) or on already-mounted userdata, any unprivileged user with file access reaches __get_node_folio via write then lookup; no CAP_SYS_ADMIN is needed on that syscall path.\nUI:N - The attacker dirties the node and then looks up the type-confused nid themselves; removable f2fs is commonly auto-mounted and scanned without a separate victim mount or open step.\nS:U - Dirty-flag mishandling, persisted node metadata, and any page-cache fallout remain in the host kernel\u0027s authority; this is not a VM escape, container breakout, or IOMMU bypass.\nC:H - A still-dirty corrupted node folio can be written back with inconsistent mappings, and a later read_node_folio will read into that dirty folio; file offsets can then resolve to other files\u0027 or leftover blocks and disclose their contents.\nI:H - Writeback of the leftover dirty node persists inconsistent footer/checksum metadata, and the subsequent read into a dirty folio overwrites in-memory node contents from disk, corrupting block maps in an attacker-influenced way.\nA:H - Footer failure on a still-dirty node stops checkpoint (and panics with errors=panic), can leak F2FS_DIRTY_NODES so checkpoint retries hang, and dirty !uptodate node folios can oops or freeze filesystem I/O."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:39:06.994Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ab35ae07f2b5b4e118ea47b88577fc7d0e797b17"
        },
        {
          "url": "https://git.kernel.org/stable/c/3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b86eab84ac8e9289b5afc52ef88ab18ba5bacab"
        }
      ],
      "title": "f2fs: fix to clear dirty flag on folio in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89832",
    "datePublished": "2026-09-16T10:31:04.691Z",
    "dateReserved": "2026-09-11T19:38:34.769Z",
    "dateUpdated": "2026-09-16T14:39:06.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89832",
      "date": "2026-09-25",
      "epss": "0.00173",
      "percentile": "0.0595"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/node.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ab35ae07f2b5b4e118ea47b88577fc7d0e797b17",
                    "status": "affected",
                    "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2",
                    "status": "affected",
                    "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b86eab84ac8e9289b5afc52ef88ab18ba5bacab",
                    "status": "affected",
                    "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "8d7ebdd109b4654ec5e0e9c3c6f08b06d6558f10",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "b039536485970829918aa237a08417bd0ed5437c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "affected",
                    "version": "5.1.10",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/f2fs/node.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.51",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to clear dirty flag on folio in error path\n\nIf node block is corrupted due to chksum mismatch or inconsistent\nfooter info, it needs to drop clear flag of node folio, in order\nto persist inconsistent node data to storage."
          }
        ],
        "id": "CVE-2026-89832",
        "lastModified": "2026-09-16T15:18:12.070",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-16T11:16:49.973",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5b86eab84ac8e9289b5afc52ef88ab18ba5bacab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ab35ae07f2b5b4e118ea47b88577fc7d0e797b17"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.