CVE-2026-89839f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() f2fs_xattr_advise_set() calls inode_owner_or_capable() with &nop_mnt_idmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to the ->set() handler. f2fs supports idmapped mounts, so on such a mount this checks the caller's fsuid against the unmapped on-disk owner rather than the mapped owner: the actual owner can be wrongly denied with -EPERM and an unrelated caller wrongly allowed. Pass the handler's idmap instead.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 01beba7957a26f9b7179127e8ad56bb5a0f56138 before 4c0c610b480cfbc57528aa1acbd6be12ed2a6fb1; from 01beba7957a26f9b7179127e8ad56bb5a0f56138 before c3e2692c7a58e0bdb84bd658d827e89dcecea3ad; from 01beba7957a26f9b7179127e8ad56bb5a0f56138 before 3b681229e9f8fb1dd29bc65983bf3c87779e4ca3; from 01beba7957a26f9b7179127e8ad56bb5a0f56138 before ab31e3b774f5d06b4489cef6c297b48c47c9dcbd; from 01beba7957a26f9b7179127e8ad56bb5a0f56138 before a54ffce4637acb0db8e695188a6c7f99f14c3576 | CNA record |
References
- https://git.kernel.org/stable/c/4c0c610b480cfbc57528aa1acbd6be12ed2a6fb1
- https://git.kernel.org/stable/c/c3e2692c7a58e0bdb84bd658d827e89dcecea3ad
- https://git.kernel.org/stable/c/3b681229e9f8fb1dd29bc65983bf3c87779e4ca3
- https://git.kernel.org/stable/c/ab31e3b774f5d06b4489cef6c297b48c47c9dcbd
- https://git.kernel.org/stable/c/a54ffce4637acb0db8e695188a6c7f99f14c3576
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.