CVE-2026-89837 Overview
CVE-2026-89837 is a memory leak vulnerability in the Linux kernel's Flash-Friendly File System (f2fs) directory lookup path. The flaw resides in the find_in_level() function, which acquires a dentry folio reference through f2fs_find_data_folio() before invoking find_in_block(). When find_in_block() returns an error, the function stores the error in res_folio and exits the loop without releasing the previously acquired dentry folio reference. Each triggering directory lookup leaks one folio reference, gradually exhausting kernel memory on affected systems.
Critical Impact
Repeated directory lookups that hit the error path in find_in_block() leak folio references, contributing to memory pressure and potential denial-of-service conditions on long-running f2fs workloads.
Affected Products
- Linux kernel versions containing the f2fs find_in_level() implementation prior to the fix commits
- Distributions shipping vulnerable f2fs code (Android devices frequently use f2fs on user data partitions)
- Embedded and mobile systems using f2fs as the primary filesystem
Discovery Timeline
- 2026-09-16 - CVE-2026-89837 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89837
Vulnerability Analysis
The vulnerability sits in the f2fs directory entry lookup logic within fs/f2fs/dir.c. The find_in_level() function iterates through directory blocks searching for a matching dentry. For each iteration, it calls f2fs_find_data_folio() to obtain a reference-counted folio containing directory data, then hands that folio to find_in_block() for parsing.
On the successful path, ownership of the folio transfers to the caller via res_folio, and the reference is released later. On the error path, however, the function assigns the error pointer to res_folio and breaks out of the loop. The dentry folio acquired earlier is never released. Each error occurrence leaks one folio reference in the page cache.
Over time, leaked references prevent the page cache from reclaiming affected folios. Workloads that repeatedly trigger directory lookups against corrupted or malformed directory blocks accelerate the leak, degrading system performance and eventually leading to resource exhaustion.
Root Cause
The root cause is missing cleanup on an error path. The find_in_level() function does not call f2fs_folio_put() on the dentry folio before propagating the error from find_in_block(). The fix drops the dentry folio reference before returning the error to the caller.
Attack Vector
Exploitation requires local access and the ability to trigger directory lookups that force find_in_block() into its error path. A local attacker with the ability to craft or mount malformed f2fs images, or to repeatedly invoke lookups against directories in an inconsistent state, can incrementally leak kernel memory. This is a resource-exhaustion class defect rather than a code execution primitive.
No verified public exploit code exists. See the upstream commits for the exact code change: Kernel Git Commit 93a3e6a, Kernel Git Commit aefb4b0f, and Kernel Git Commit cca7d3e3.
Detection Methods for CVE-2026-89837
Indicators of Compromise
- Steady, unexplained growth in kernel page cache attributable to f2fs directory data folios
- Recurring f2fs error messages in dmesg referencing directory block reads or dentry lookup failures
- Progressive memory pressure on systems mounting f2fs volumes despite stable userspace workloads
Detection Strategies
- Audit running kernel versions against the fixed commits referenced in the upstream Linux stable tree
- Correlate f2fs mount events with subsequent kernel memory growth using host telemetry
- Monitor /proc/meminfo and /proc/slabinfo for anomalous folio and page cache retention on f2fs hosts
Monitoring Recommendations
- Collect kernel logs centrally and alert on repeated f2fs directory lookup errors
- Track kernel version inventory across Linux and Android fleets to identify unpatched hosts
- Baseline page cache growth per filesystem and flag deviations on f2fs-backed volumes
How to Mitigate CVE-2026-89837
Immediate Actions Required
- Identify Linux hosts and devices using f2fs, including Android endpoints and embedded systems
- Apply the stable kernel update that includes the fix commits 93a3e6a4c9e7, aefb4b0f465b, and cca7d3e30bf3
- Reboot affected systems after patching to load the corrected kernel image
Patch Information
The fix drops the dentry folio reference on the error path in find_in_level() before returning. Upstream commits are available at Kernel Git Commit 93a3e6a, Kernel Git Commit aefb4b0f, and Kernel Git Commit cca7d3e3. Consume the fix through your distribution's kernel update channel once backports are published.
Workarounds
- Where feasible, migrate affected directories to a non-f2fs filesystem until patched kernels are deployed
- Schedule periodic reboots on long-running f2fs hosts to reclaim leaked page cache memory
- Restrict local user ability to mount untrusted f2fs images by tightening mount privileges and udev rules
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.