CVE-2026-89833: Linux Kernel Race Condition Vulnerability

CVE-2026-89833 Overview

CVE-2026-89833 is a race condition vulnerability in the Linux kernel's Flash-Friendly File System (f2fs) implementation. The flaw resides in the f2fs_fsync_node_pages() function, where concurrent execution of fsync and f2fs_truncate operations can trigger an infinite retry loop. When one thread holds a folio reference during fsync and another thread invalidates the folio's mapping via truncate, the is_node_folio check returns false indefinitely. This causes the kernel to spin in a retry path, resulting in a kernel-level denial of service on affected f2fs volumes.

Critical Impact
Local attackers or unprivileged workloads triggering concurrent fsync and truncate operations on f2fs can cause a kernel deadloop, hanging the affected process and consuming CPU resources.

Affected Products

Linux kernel builds containing the vulnerable f2fs f2fs_fsync_node_pages() code path
Distributions shipping f2fs prior to the upstream fix commits 161513f, 905411f, and ce366bf
Systems mounting f2fs volumes with concurrent fsync and truncate workloads

Discovery Timeline

2026-09-16 - CVE-2026-89833 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89833

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] between two kernel threads operating on the same f2fs node folio. Thread A executes the fsync path through f2fs_do_sync_file into f2fs_fsync_node_pages, which calls folio_get(last_folio) on the last dirty node folio. Concurrently, Thread B enters f2fs_setattr and follows the truncate chain through f2fs_truncate_blocks and f2fs_truncate_inode_blocks down to truncate_node. Inside truncate_node, the call to invalidate_mapping_pages sets folio->mapping = NULL.

Once the mapping is nullified, Thread A's subsequent is_node_folio check always returns false. The combination of atomic && !marked remains true, forcing execution into the goto retry branch. The loop never terminates because the folio state cannot change to satisfy the exit condition. The result is a kernel thread stuck in a busy retry cycle within the fsync path.

Root Cause

The root cause is missing synchronization between the fsync folio-tracking logic and the concurrent truncate path that invalidates page mappings. f2fs_fsync_node_pages() assumes the last folio's mapping remains valid across the retry loop, but invalidate_mapping_pages in the truncate path can clear it at any point. The retry condition does not detect this mapping loss and treat it as terminal.

Attack Vector

Exploitation requires local access to a system with a mounted f2fs volume. A process performing fsync() on an inode while another process concurrently truncates or modifies attributes on the same file can trigger the race. The vulnerable code path is described in the upstream commit references. Details of the fix are available in Kernel Git Commit 161513f, Kernel Git Commit 905411f, and Kernel Git Commit ce366bf.

Detection Methods for CVE-2026-89833

Indicators of Compromise

Kernel threads stuck at 100% CPU inside f2fs_fsync_node_pages visible in /proc/<pid>/stack
Application processes hanging in the D (uninterruptible sleep) state during fsync operations on f2fs mounts
hung_task warnings in dmesg referencing f2fs fsync or truncate call paths

Detection Strategies

Enable kernel hung_task_timeout_secs monitoring and forward dmesg output to a centralized log store for correlation
Sample kernel stack traces on high-CPU kthreads and match against the f2fs fsync retry path
Track running kernel version and f2fs commit level across the fleet to identify unpatched hosts

Monitoring Recommendations

Alert on sustained per-thread kernel CPU usage combined with f2fs mount points
Collect perf samples that identify repeated calls into f2fs_fsync_node_pages and is_node_folio
Monitor process state distributions to detect spikes in uninterruptible sleep on file I/O workloads

How to Mitigate CVE-2026-89833

Immediate Actions Required

Inventory hosts running f2fs and identify kernel builds that predate commits 161513f, 905411f, and ce366bf
Schedule kernel updates on affected systems to a stable release incorporating the upstream fix
Restrict local access on systems where the vulnerable kernel cannot be patched immediately

Patch Information

The fix is available in the upstream Linux kernel through three commits referenced in the NVD entry: Kernel Git Commit 161513f, Kernel Git Commit 905411f, and Kernel Git Commit ce366bf. Apply the vendor-provided kernel package that includes these commits and reboot into the patched kernel.

Workarounds

Migrate affected workloads from f2fs to an alternative file system such as ext4 or xfs where operationally feasible
Limit concurrent fsync and truncate workloads on the same inodes until a patched kernel is deployed
Apply strict local access controls to reduce the population of users who can trigger the race