CVE-2026-89836

{
  "id": "CVE-2026-89836",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-16T11:16:50.400",
  "lastModified": "2026-10-19T09:18:27.510",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix folio_nr_pages() race after put in large folio invalidate\n\nOur v6.18 based Android system is continuely suffering livelock and bad\npage stat as shown in[1] which related to broken xarray slot status. By\ninvestigating big folio operations within f2fs, we find below races and\nfix it by get the nr_pages before drop the refcount and folio_lock.\n\nf2fs_get_read_data_folio() calls f2fs_folio_put() before\nfolio_nr_pages() when invalidating a large folio from the page cache.\nThat unlocks the folio and drops the caller reference, leaving a window\nwhere a concurrent truncate or folio split can shrink the compound folio\nor free it before the invalidate range is computed. An undersized range\nthen leaves split sub-folios in mapping->i_pages, which can later\ninteract badly with truncate and reclaim (stale xarray entries and bad\npage state when folio->mapping no longer matches the mapping being\ntruncated).\n\n[1]\nPID: 2594     TASK: ffffff8169b81580  CPU: 7    COMMAND: \"Thread-3\"\n #0 [ffffffc08ef2b8a0] xas_load at ffffffe52d1f42a4\n #1 [ffffffc08ef2b900] find_get_entries at ffffffe52c185798\n #2 [ffffffc08ef2bb60] truncate_inode_pages_range at ffffffe52c19e83c\n #3 [ffffffc08ef2bbc0] truncate_inode_pages_final at ffffffe52c19ec2c\n #4 [ffffffc08ef2bc20] f2fs_evict_inode at ffffffe52c4c8400\n #5 [ffffffc08ef2bcc0] evict at ffffffe52c2de9f4\n #6 [ffffffc08ef2bd00] iput at ffffffe52c2db1b4\n #7 [ffffffc08ef2bd30] dentry_unlink_inode at ffffffe52c2d7204\n #8 [ffffffc08ef2bd50] __dentry_kill at ffffffe52c2d3dcc\n #9 [ffffffc08ef2bd80] dput at ffffffe52c2d3c3c\n #10 [ffffffc08ef2bda0] __fput at ffffffe52c2b0a7c\n #11 [ffffffc08ef2bde0] ____fput at ffffffe52c2b1034\n #12 [ffffffc08ef2bdf0] task_work_run at ffffffe52beea200\n #13 [ffffffc08ef2be20] exit_to_user_mode_loop at ffffffe52bfbc17c\n #14 [ffffffc08ef2be80] el0_svc at ffffffe52d1f8e54\n #15 [ffffffc08ef2beb0] el0t_64_sync_handler at ffffffe52d1f8d10"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/f2fs/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "05e65c14ea59a401cec4284e9d612f9d5dc1b3f8",
              "lessThan": "cc34df18da92f68f9b384c3ae95ad64be46cb5ee",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "05e65c14ea59a401cec4284e9d612f9d5dc1b3f8",
              "lessThan": "0dab71381f1b4d12dc2056f8bd5aaa9d93ce9082",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/f2fs/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "7.0",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "7.0",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.5",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0dab71381f1b4d12dc2056f8bd5aaa9d93ce9082",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cc34df18da92f68f9b384c3ae95ad64be46cb5ee",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}