CVE-2026-89840f2fs: validate MOVE_RANGE destination size
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: f2fs: validate MOVE_RANGE destination size F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len. Reject destination overflow and use inode_newsize_ok() before extending the destination inode.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 4dd6f977fc778e5a0da604e5f8cb2f36d163d27b before bca61ee5192ea47003722486ae9588a2a4bb47b6; from 4dd6f977fc778e5a0da604e5f8cb2f36d163d27b before db13064669526494cd78ba3a4394063b740e940c; from 4dd6f977fc778e5a0da604e5f8cb2f36d163d27b before dcae1eeda53149f219dd6af93b3083b7271c1c63; from 4dd6f977fc778e5a0da604e5f8cb2f36d163d27b before e533889fc26aea0cd83c90327063f272061dd820 | CNA record |
References
- https://git.kernel.org/stable/c/bca61ee5192ea47003722486ae9588a2a4bb47b6
- https://git.kernel.org/stable/c/db13064669526494cd78ba3a4394063b740e940c
- https://git.kernel.org/stable/c/dcae1eeda53149f219dd6af93b3083b7271c1c63
- https://git.kernel.org/stable/c/e533889fc26aea0cd83c90327063f272061dd820
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.