CVE-2026-89841: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89841 Overview

CVE-2026-89841 is a Linux kernel vulnerability in the Flash-Friendly File System (f2fs) subsystem. The flaw resides in the redirty_blocks() function, where a reference counting error can corrupt page cache state. When read_cache_folio() fails before any folio is pinned, the cleanup path still executes one iteration and calls folio_put_refs(folio, 2), dropping one reference more than was acquired. Subsequent drop_caches operations or memory reclaim can then trigger a "BUG: Bad page state" condition. The bug was introduced by commit 5951fee46bef ("f2fs: Use a folio in redirty_blocks()") when the second pass was converted to a do/while loop.

Critical Impact
Local attackers with low privileges can trigger kernel memory corruption in the page cache, leading to system instability, denial of service, or potential privilege escalation on systems using f2fs.

Affected Products

Linux kernel versions containing commit 5951fee46bef ("f2fs: Use a folio in redirty_blocks()")
Distributions shipping f2fs-enabled kernels prior to the patch
Systems using f2fs as a mounted filesystem (common on Android, embedded Linux, and flash-storage deployments)

Discovery Timeline

2026-09-16 - CVE-2026-89841 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89841

Vulnerability Analysis

The vulnerability is a reference counting error in the f2fs filesystem's redirty_blocks() routine. This function operates in two passes: first, it pins folios in the page cache using read_cache_folio(), then it walks the same range using filemap_lock_folio() to redirty each folio and release the pinning references it obtained.

The regression was introduced when the second pass was refactored into a do/while loop. In the original for-loop form, page_idx advanced only after a successful pin. In the do/while form, if read_cache_folio() fails on the very first folio, page_idx does not advance but the cleanup path executes at least one iteration.

If readahead has already inserted the target folio into the page cache, filemap_lock_folio() succeeds on a folio that redirty_blocks() never pinned. The subsequent folio_put_refs(folio, 2) call then drops two references when only one is owed, producing a stale refcount. The corruption remains latent until reclaim or drop_caches walks the affected folio and detects the inconsistent state.

Root Cause

The root cause is an off-by-one iteration in error-handling logic, classified as an improper resource release. The do/while cleanup loop unconditionally executes one pass before checking the loop condition, causing the code to release references it never acquired when the pinning phase fails early.

Attack Vector

Exploitation requires local access with low privileges on a system using f2fs. An attacker can craft conditions that cause read_cache_folio() to fail — for example, by inducing memory pressure or I/O errors — while readahead concurrently populates the target range. Triggering drop_caches afterward reveals the corrupted state as a kernel bug. The vulnerability enables denial of service and, depending on the surrounding page cache state, can be leveraged toward memory corruption primitives.

No verified public proof-of-concept code is available. Refer to the upstream fix commits 445e4a1, 8517133, and 89c65ec for technical details of the corrected iteration boundaries.

Detection Methods for CVE-2026-89841

Indicators of Compromise

Kernel log entries containing BUG: Bad page state messages referencing folios owned by f2fs-backed files
Unexpected kernel oops or panic events following echo 3 > /proc/sys/vm/drop_caches on hosts with f2fs mounts
Repeated f2fs I/O failures correlated with memory pressure events in dmesg

Detection Strategies

Monitor /var/log/kern.log and dmesg for Bad page state and f2fs-tagged warnings, especially on systems where f2fs is used for user-writable mounts
Track kernel version and patch level against the fix commits listed in the upstream references
Alert on abnormal frequency of drop_caches invocations by unprivileged processes

Monitoring Recommendations

Enable kernel audit logging for filesystem operations on f2fs mounts and forward events to a centralized log platform
Baseline expected kernel warning volume and alert on deviations that could indicate exploitation attempts
Correlate memory pressure metrics with filesystem error rates to identify pre-conditions attackers may induce

How to Mitigate CVE-2026-89841

Immediate Actions Required

Inventory all Linux systems using f2fs and identify kernel versions against the vulnerable commit 5951fee46bef
Apply the upstream patches referenced by commits 445e4a1e6025ecd5312e9a95c1b234192c976ca1, 85171332742e741ccd6f401c69b6e0d698119e72, and 89c65ec3c18903de763cf567c96ab3ef60e5f3b0
Restrict local shell access on multi-tenant systems until patches are deployed

Patch Information

The fix constrains redirty_blocks() to only redirty the range that was pinned successfully, preventing the cleanup path from dropping references on folios it never owned. See the upstream commits: Kernel Patch 445e4a1, Kernel Patch 8517133, and Kernel Patch 89c65ec. Deploy vendor-provided kernel updates from your distribution as soon as they become available.

Workarounds

Where feasible, avoid mounting f2fs filesystems and use an alternative filesystem such as ext4 or xfs until patched kernels are deployed
Limit the ability of unprivileged users to trigger memory pressure or invoke drop_caches by tightening sysctl and cgroup policies
Reduce readahead aggressiveness on f2fs mounts to lower the probability of the race window

bash

# Check current kernel version and f2fs usage
uname -r
mount | grep f2fs

# Reduce readahead on an f2fs-mounted block device (example: /dev/sda1)
blockdev --setra 0 /dev/sda1

# Restrict drop_caches access to root only (default on most systems)
sysctl -w kernel.dmesg_restrict=1