CVE-2026-89838: Linux Kernel F2FS Information Disclosure Flaw

CVE-2026-89838 Overview

CVE-2026-89838 is an out-of-bounds read vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) recovery code. The flaw resides in the recover_inode() and recover_dentry() functions, which log filenames stored in the on-disk i_name buffer using the %s format specifier. The buffer is not NUL-terminated, and the logging path does not bound the read to the stored i_namelen. Processing a 255-byte filename during recovery reads past i_name into adjacent raw inode fields, exposing kernel memory contents to the log stream.

Critical Impact
A local attacker with the ability to craft or trigger F2FS recovery can leak adjacent raw inode fields into kernel logs and induce availability impact on the file system.

Affected Products

Linux kernel with F2FS enabled
Distributions shipping affected mainline and stable kernel branches
Systems mounting F2FS volumes that undergo crash recovery

Discovery Timeline

2026-09-16 - CVE-2026-89838 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89838

Vulnerability Analysis

F2FS persists recovery filenames as a length field paired with a fixed-size i_name buffer inside the raw inode structure. The buffer omits a terminating NUL byte because the length is tracked explicitly by i_namelen. During roll-forward recovery, the kernel invokes logging helpers that emit the filename using %s, which iterates until it encounters a NUL byte. When a stored filename occupies the maximum 255 bytes, the format routine walks past the end of i_name and consumes bytes from the adjacent raw inode fields.

This is a classic out-of-bounds read [CWE-125] caused by mixing length-prefixed data with a NUL-terminated string API. The read discloses inode metadata into the kernel log ring buffer and can destabilize recovery when trailing bytes contain unexpected non-printable content. The upstream fix bounds the %s conversion using a precision limited by both i_namelen and F2FS_NAME_LEN, preventing the format specifier from reading beyond the stored filename length.

Root Cause

The root cause is the use of an unbounded %s conversion against a non-NUL-terminated, length-prefixed buffer. The i_name field has a fixed size, and the accompanying i_namelen accurately reflects the valid byte count, but the logging path ignored i_namelen and relied on string termination that the on-disk format does not guarantee.

Attack Vector

Exploitation requires local access and the ability to influence F2FS recovery, for example by mounting a crafted F2FS image or by triggering roll-forward recovery on a volume containing a directory entry with a 255-byte name. No user interaction is required beyond triggering the recovery path. The impact is limited to information disclosure of adjacent kernel inode fields via the log stream and potential availability impact during recovery processing.

No verified public exploit code is available. See the upstream commits Kernel.org Commit 01027b2 and Kernel.org Commit 317d32e for the corrective changes.

Detection Methods for CVE-2026-89838

Indicators of Compromise

Kernel log entries from recover_inode or recover_dentry containing non-printable bytes or unexpectedly long filename strings.
Repeated F2FS recovery events tied to mounts of user-supplied or removable media images.
Panics or file system errors triggered immediately after mount of an F2FS volume.

Detection Strategies

Audit dmesg and journald for F2FS recovery messages that emit filenames exceeding 255 printable characters.
Correlate mount events for F2FS volumes with subsequent kernel warnings referencing inode recovery.
Track kernel package versions across the fleet to identify hosts running pre-patch F2FS code.

Monitoring Recommendations

Forward kernel logs to a central platform and alert on F2FS recovery activity from non-system volumes.
Monitor mount syscalls that specify f2fs as the file system type from unprivileged contexts or containers.
Baseline expected F2FS recovery frequency per host and flag statistical anomalies.

How to Mitigate CVE-2026-89838

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry as soon as vendor builds are available.
Restrict mounting of untrusted F2FS images to trusted administrators only.
Disable automatic mounting of removable media on servers that do not require it.

Patch Information

The fix bounds the %s conversion in recover_inode() and recover_dentry() using a precision derived from i_namelen and F2FS_NAME_LEN. The changes are documented in Kernel.org Commit 01027b2 and Kernel.org Commit 317d32e. Rebuild affected kernels from a patched source tree or install stable updates that include both commits.

Workarounds

Prevent unprivileged users from mounting F2FS volumes by tightening udev rules and mount permissions.
Where F2FS is not required, unload the f2fs kernel module and blacklist it via /etc/modprobe.d/.
Enforce Mandatory Access Control policies that block interactive users from invoking the mount syscall with the f2fs type.

bash

# Configuration example: blacklist the f2fs module on systems that do not require it
echo "blacklist f2fs" | sudo tee /etc/modprobe.d/blacklist-f2fs.conf
sudo depmod -a
sudo update-initramfs -u