{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89832", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.769Z", "datePublished": "2026-09-16T10:31:04.691Z", "dateUpdated": "2026-09-16T14:39:06.994Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-16T14:39:06.994Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to clear dirty flag on folio in error path\n\nIf node block is corrupted due to chksum mismatch or inconsistent\nfooter info, it needs to drop clear flag of node folio, in order\nto persist inconsistent node data to storage."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - __get_node_folio is reached only through local VFS operations (lookup, open, read/write, fallocate, fsync, GC) on a mounted f2fs volume such as Android userdata or removable flash; it is not a ksmbd/nfsd/packet-processing path.\nAC:L - A crafted f2fs image lets the attacker pick node footers and nids so a dirty direct-node folio is later re-fetched as NODE_TYPE_INODE (or fails checksum) on ordinary file ops; triggering is deterministic with no race or rare config.\nPR:L - After automount (Android vold/udisks2 portable f2fs) or on already-mounted userdata, any unprivileged user with file access reaches __get_node_folio via write then lookup; no CAP_SYS_ADMIN is needed on that syscall path.\nUI:N - The attacker dirties the node and then looks up the type-confused nid themselves; removable f2fs is commonly auto-mounted and scanned without a separate victim mount or open step.\nS:U - Dirty-flag mishandling, persisted node metadata, and any page-cache fallout remain in the host kernel's authority; this is not a VM escape, container breakout, or IOMMU bypass.\nC:H - A still-dirty corrupted node folio can be written back with inconsistent mappings, and a later read_node_folio will read into that dirty folio; file offsets can then resolve to other files' or leftover blocks and disclose their contents.\nI:H - Writeback of the leftover dirty node persists inconsistent footer/checksum metadata, and the subsequent read into a dirty folio overwrites in-memory node contents from disk, corrupting block maps in an attacker-influenced way.\nA:H - Footer failure on a still-dirty node stops checkpoint (and panics with errors=panic), can leak F2FS_DIRTY_NODES so checkpoint retries hang, and dirty !uptodate node folios can oops or freeze filesystem I/O."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/node.c"], "versions": [{"version": "b42b179bda9ff11075a6fc2bac4d9e400513679a", "lessThan": "ab35ae07f2b5b4e118ea47b88577fc7d0e797b17", "status": "affected", "versionType": "git"}, {"version": "b42b179bda9ff11075a6fc2bac4d9e400513679a", "lessThan": "3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2", "status": "affected", "versionType": "git"}, {"version": "b42b179bda9ff11075a6fc2bac4d9e400513679a", "lessThan": "5b86eab84ac8e9289b5afc52ef88ab18ba5bacab", "status": "affected", "versionType": "git"}, {"version": "8d7ebdd109b4654ec5e0e9c3c6f08b06d6558f10", "status": "affected", "versionType": "git"}, {"version": "b039536485970829918aa237a08417bd0ed5437c", "status": "affected", "versionType": "git"}, {"version": "4.19.51", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.1.10", "lessThan": "5.2", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/f2fs/node.c"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.51", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.5", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.2.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.3-rc1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ab35ae07f2b5b4e118ea47b88577fc7d0e797b17"}, {"url": "https://git.kernel.org/stable/c/3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2"}, {"url": "https://git.kernel.org/stable/c/5b86eab84ac8e9289b5afc52ef88ab18ba5bacab"}], "title": "f2fs: fix to clear dirty flag on folio in error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/f2fs/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ab35ae07f2b5b4e118ea47b88577fc7d0e797b17", "status": "affected", "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a", "versionType": "git"}, {"lessThan": "3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2", "status": "affected", "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a", "versionType": "git"}, {"lessThan": "5b86eab84ac8e9289b5afc52ef88ab18ba5bacab", "status": "affected", "version": "b42b179bda9ff11075a6fc2bac4d9e400513679a", "versionType": "git"}, {"status": "affected", "version": "8d7ebdd109b4654ec5e0e9c3c6f08b06d6558f10", "versionType": "git"}, {"status": "affected", "version": "b039536485970829918aa237a08417bd0ed5437c", "versionType": "git"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.51", "versionType": "semver"}, {"lessThan": "5.2", "status": "affected", "version": "5.1.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/f2fs/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.51", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to clear dirty flag on folio in error path\n\nIf node block is corrupted due to chksum mismatch or inconsistent\nfooter info, it needs to drop clear flag of node folio, in order\nto persist inconsistent node data to storage."}], "id": "CVE-2026-89832", "lastModified": "2026-09-16T15:18:12.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-16T11:16:49.973", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b86eab84ac8e9289b5afc52ef88ab18ba5bacab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab35ae07f2b5b4e118ea47b88577fc7d0e797b17"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}