HIGH
f2fs NodeFooter Bypass
CVE-2026-89829
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI3.4LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() Otherwise in f2fs_sanity_check_node_footer(), it will check the same nid incorrectly.
02KernelScan AI Analysis
Risk summary
A logic error in f2fs's node page writeback sanity check causes it to compare a node ID against itself rather than against the expected value, making the check a no-op. Corrupted node footers go undetected and corrupted metadata can be written to disk. Exploitation requires mounting a crafted or corrupted f2fs filesystem image, which needs root privileges (CAP_SYS_ADMIN).
Vulnerability analysis
During node folio writeback, f2fs runs a sanity check on the node footer to detect corruption and shut down the filesystem if the stored node ID does not match the expected one. The check was incorrectly passed the node ID extracted from the folio's own footer as the expected value, so it compared that value against itself and always passed — even when the footer was corrupted. This means corrupted node metadata written through the writeback path goes undetected, potentially propagating filesystem corruption. The fix passes the folio's page index (the correct expected node ID) to the sanity check so it actually validates the footer. The vulnerable code path is reached when an f2fs filesystem is mounted and node pages are written back; mounting f2fs requires real root (CAP_SYS_ADMIN in the init namespace), so an attacker must either supply a crafted f2fs image on removable media that gets auto-mounted by a privileged service or convince a root user to mount a malicious image.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18.13 | 6.18.51 | a984446aa9d5 |
| 6.19 | 6.19.3 | 6.20 | 0b196c07407f |
| 7.2 | — | 7.2.5 | 7e188e9f9437 |
| mainline | — | 7.3 | — |