CVE-2026-89835: f2fs: avoid NULL checkpoint thread access in sysfs

CVE-2026-89835: f2fs: avoid NULL checkpoint thread access in sysfs

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

f2fs: avoid NULL checkpoint thread access in sysfs

checkpoint_merge can be enabled even when no checkpoint merge thread is
running. A read-only mount is one case: f2fs does not start
f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through
sysfs.

The ckpt_thread_ioprio store path updates the saved ioprio value and,
when checkpoint_merge is enabled, calls set_task_ioprio() for the
checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a
NULL task pointer.

Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the
checkpoint thread cannot disappear under the store path while updating
its ioprio.

The Linux kernel CVE team has assigned CVE-2026-89835 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.12 with commit e65920661708b7c0f3db45c9cd5d0095034ee37f and fixed in 6.12.110 with commit a6573f3ffc19542de9ebc1a2b1f930fd48ba538c
	Issue introduced in 5.12 with commit e65920661708b7c0f3db45c9cd5d0095034ee37f and fixed in 6.18.51 with commit aefcec3bebdeed2bff444378122300763325ba23
	Issue introduced in 5.12 with commit e65920661708b7c0f3db45c9cd5d0095034ee37f and fixed in 7.2.5 with commit 8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b
	Issue introduced in 5.12 with commit e65920661708b7c0f3db45c9cd5d0095034ee37f and fixed in 7.3-rc1 with commit 5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89835
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/f2fs/sysfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a6573f3ffc19542de9ebc1a2b1f930fd48ba538c
	https://git.kernel.org/stable/c/aefcec3bebdeed2bff444378122300763325ba23
	https://git.kernel.org/stable/c/8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b
	https://git.kernel.org/stable/c/5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f