HIGH
f2fs NodeFolio Corruption
CVE-2026-89832
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to clear dirty flag on folio in error path If node block is corrupted due to chksum mismatch or inconsistent footer info, it needs to drop clear flag of node folio, in order to persist inconsistent node data to storage.
02KernelScan AI Analysis
Risk summary
A crafted or corrupted f2fs filesystem image can cause the kernel to persist inconsistent node data to storage because the error path fails to clear the dirty flag on the folio. This permanently corrupts the filesystem and can lead to kernel panics or data exposure when the corrupted data is later read. Any local user with access to files on an affected f2fs filesystem can trigger the vulnerable code path.
Vulnerability analysis
When f2fs detects a corrupted node block during checksum verification, the error path fails to prevent the corrupted data from being written back to storage, which can permanently damage the filesystem. The fix ensures that corrupted node data is discarded rather than persisted when an error is detected. This vulnerability is reachable by mounting a crafted f2fs filesystem image, which requires root privileges, or by any local user performing file operations on an already-mounted f2fs filesystem that contains corrupted node blocks.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 4.19 | 4.19.51 | 4.20 | 21b7f66716b4 |
| 5.1 | 5.1.10 | 5.2 | 34732e3a8713 |
| 6.12 | — | 6.12.112 | 3923ec2b98c9 |
| 6.18 | — | 6.18.51 | 5b86eab84ac8 |
| 6.6 | — | 6.6.160 | ab35ae07f2b5 |
| 7.2 | — | 7.2.5 | — |
| mainline | — | 7.3 | — |
| cip/6.12 | — | 6.12.112-cip33 | 34732e3a8713 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.112-cip33 |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |