CVE-2026-89830f2fs: fix valid block count leak on data block allocation failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In __allocate_data_block(), when allocating a new data block (dn->data_blkaddr == NULL_ADDR), inc_valid_block_count() is called first to increment total_valid_block_count and i_blocks. If the subsequent f2fs_allocate_data_block() fails, the function returns the error directly without rolling back the already-incremented block counts, causing a permanent leak. Fix this by calling dec_valid_block_count() to undo the increment before returning the error. The condition old_blkaddr == NULL_ADDR precisely identifies the case where inc_valid_block_count() was called.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 7d009e048d7cfcc21d400f2aba4c8bacbdebbd47 builds before 2d50b6d47e5671ff6a25834c5906d443356191f0; from 7d009e048d7cfcc21d400f2aba4c8bacbdebbd47 before dde99df5a9d3b0ca6ac0a86f98799685f7399432; from 7d009e048d7cfcc21d400f2aba4c8bacbdebbd47 before 931e1aa4d44c52ff8e0feb38420a8827c62e886b; 7d009e048d7cfcc21d400f2aba4c8bacbdebbd47 builds before 0f9af07ecc1ab486038373db6ae0436c5d674b19 | CNA record |
References
- https://git.kernel.org/stable/c/2d50b6d47e5671ff6a25834c5906d443356191f0
- https://git.kernel.org/stable/c/dde99df5a9d3b0ca6ac0a86f98799685f7399432
- https://git.kernel.org/stable/c/931e1aa4d44c52ff8e0feb38420a8827c62e886b
- https://git.kernel.org/stable/c/0f9af07ecc1ab486038373db6ae0436c5d674b19
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.