CVE-2026-89835: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89835 Overview

CVE-2026-89835 is a NULL pointer dereference vulnerability in the Linux kernel's Flash-Friendly File System (f2fs). The flaw resides in the sysfs interface that handles the ckpt_thread_ioprio attribute. When checkpoint_merge is enabled without a running checkpoint merge thread, such as during a read-only mount, writing to the sysfs attribute dereferences a NULL task pointer. The kernel does not start f2fs_issue_ckpt in this state, yet the attribute remains writable. This creates a code path where a local write triggers a kernel NULL pointer dereference, leading to a denial-of-service condition.

Critical Impact
A local user with sysfs write access can trigger a kernel NULL pointer dereference in f2fs, causing a kernel oops and denial of service on affected Linux systems.

Affected Products

Linux kernel with f2fs support enabled
Systems mounting f2fs filesystems (including read-only mounts)
Distributions shipping vulnerable kernel versions prior to the upstream fix

Discovery Timeline

2026-09-16 - CVE-2026-89835 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89835

Vulnerability Analysis

The vulnerability lives in the f2fs sysfs handler for the ckpt_thread_ioprio attribute. This attribute controls the I/O priority of the checkpoint merge thread. The store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() on the checkpoint thread task structure.

The f2fs subsystem allows checkpoint_merge to be enabled even when no checkpoint merge thread is running. A read-only mount is the primary example: f2fs skips starting f2fs_issue_ckpt, but the sysfs attribute stays writable. When cprc->f2fs_issue_ckpt is NULL, set_task_ioprio() receives a NULL task pointer and dereferences it. The result is a kernel oops in the store path.

Root Cause

The root cause is missing state validation between the sysfs write path and the checkpoint thread lifecycle. The store handler assumes that an enabled checkpoint_merge flag implies a live thread, but that invariant does not hold. This is a NULL pointer dereference [CWE-476] combined with a lifecycle synchronization gap between the mount state machine and the sysfs interface.

Attack Vector

A local user with write access to the f2fs sysfs attribute can trigger the dereference. Reproduction requires mounting an f2fs volume read-only or otherwise placing the filesystem in a state where the checkpoint issue thread is absent while checkpoint_merge remains enabled. Writing to ckpt_thread_ioprio then dereferences the NULL task pointer, producing a kernel oops. The attack requires local access and sysfs write permissions, which are typically restricted to privileged users.

// Vulnerability pattern (prose description)
// The store handler for ckpt_thread_ioprio calls
// set_task_ioprio(cprc->f2fs_issue_ckpt, value) without
// verifying that cprc->f2fs_issue_ckpt is non-NULL.
// On a read-only mount, this pointer is NULL, so the
// dereference inside set_task_ioprio faults.
// See kernel commits referenced in the advisory for the fix.

Detection Methods for CVE-2026-89835

Indicators of Compromise

Kernel oops or panic messages referencing set_task_ioprio or f2fs_sbi_store in dmesg or /var/log/kern.log
Unexpected write activity to /sys/fs/f2fs/<device>/ckpt_thread_ioprio on read-only mounted volumes
Repeated crashes correlated with f2fs sysfs write operations from unprivileged shells or scripts

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereference traces originating in the f2fs sysfs code path
Audit write syscalls targeting f2fs sysfs attributes using auditd rules on /sys/fs/f2fs/*/ckpt_thread_ioprio
Correlate kernel crash telemetry with mount state to identify read-only f2fs volumes receiving sysfs writes

Monitoring Recommendations

Enable kdump or crash reporting to capture kernel oops artifacts for post-incident analysis
Aggregate dmesg output centrally and alert on stack traces containing f2fs and ioprio symbols
Track kernel version inventory across the fleet to surface hosts still running unpatched f2fs code

How to Mitigate CVE-2026-89835

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the advisory as soon as vendor builds are available
Restrict write access to f2fs sysfs attributes to trusted administrators only
Avoid enabling checkpoint_merge on filesystems that are mounted read-only until patched

Patch Information

The fix protects ckpt_thread_ioprio sysfs writes with s_umount, ensuring the checkpoint thread cannot disappear under the store path while its ioprio is updated. The patches are available in the following upstream commits: Kernel Git Commit 5cb33b00, Kernel Git Commit 8f3b99c5, Kernel Git Commit a6573f3f, and Kernel Git Commit aefcec3b.

Workarounds

Limit local user access on hosts that mount f2fs volumes to reduce exposure to the sysfs write path
Set stricter permissions on /sys/fs/f2fs/<device>/ckpt_thread_ioprio where operational policy allows
Avoid read-only f2fs mounts on systems where checkpoint_merge may be toggled through sysfs until the kernel is patched

bash

# Restrict write access to the affected sysfs attribute
chmod 0600 /sys/fs/f2fs/*/ckpt_thread_ioprio

# Verify kernel version after patching
uname -r