CVE-2026-89835f2fs: avoid NULL checkpoint thread access in sysfs
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e65920661708b7c0f3db45c9cd5d0095034ee37f before a6573f3ffc19542de9ebc1a2b1f930fd48ba538c; from e65920661708b7c0f3db45c9cd5d0095034ee37f before aefcec3bebdeed2bff444378122300763325ba23; from e65920661708b7c0f3db45c9cd5d0095034ee37f before 8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b; from e65920661708b7c0f3db45c9cd5d0095034ee37f before 5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f | CNA record |
References
- https://git.kernel.org/stable/c/a6573f3ffc19542de9ebc1a2b1f930fd48ba538c
- https://git.kernel.org/stable/c/aefcec3bebdeed2bff444378122300763325ba23
- https://git.kernel.org/stable/c/8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b
- https://git.kernel.org/stable/c/5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.