HIGH Introduced in 4.8
f2fs MoveRange Overflow
CVE-2026-89840
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
KernelScan AI7.4HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVE_RANGE destination size F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len. Reject destination overflow and use inode_newsize_ok() before extending the destination inode.
02KernelScan AI Analysis
Risk summary
A local user with write access to files on a mounted F2FS filesystem can trigger an integer overflow in the move-range ioctl, causing the destination inode's size to be set to an incorrect or excessive value. This leads to filesystem metadata corruption and potential kernel crashes or resource exhaustion. Any system exposing F2FS filesystems to untrusted local users or container workloads is at risk.
Vulnerability analysis
The F2FS move-range ioctl validates the source file range but does not check whether the destination offset plus length overflows or exceeds filesystem limits before extending the destination inode's size. When the source file contains holes, the block-cloning routine skips the missing entries and returns success, so the caller proceeds to set the destination file's size using an unchecked sum that can wrap around or exceed the maximum supported file size. The fix adds an explicit overflow check on the destination end offset and calls the standard inode size validation helper before extending the destination inode, rejecting requests that would overflow or exceed limits. The bug is reachable by any local user who holds a file descriptor with write access on a mounted F2FS filesystem; no special capabilities are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.8 | 6.12.112 | bca61ee5192e |
| 6.18 | 4.8 | 6.18.53 | db1306466952 |
| 6.6 | 4.8 | 6.6.160 | 54c587f3f95c |
| 7.2 | 4.8 | 7.2.5 | dcae1eeda531 |
| mainline | 4.8 | 7.3 | e533889fc26a |
| cip/6.12 | 4.8 | 6.12.112-cip33 | bca61ee5192e |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.112-cip33 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |