From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 75F8E49DBBA for ; Wed, 16 Sep 2026 10:34:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789554899; cv=none; b=PjJFDcn93WaMCHMY2DAKcWQVXSR5hBhVgZDzgHMwLJfmRlM0u35eu1vGkxnEd96ZneOobZV6HBGZlzZti4UA3DQMi0AoLoIPb0npapiV3qcwWSn7E8Ico7nbsHT4+t72o8I620TRxtYZi/xjgq7jgLhwcPRVa56dtVvY4ynDnUw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789554899; c=relaxed/simple; bh=d6bt7+6vfvWwdfOZkwSAW1dIgqfU9gKRltEpVYMqJks=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=F6rYKumLuad4ArZzkPESlqL0XeLfsBH0pqG1ikKyioiO1N96NKlXOAHDbezt8Db7NQj5RbPU0q1PA6DF6vpvfUFHm1BWVS7MCX5FnYsSTk56Ps0Ehv4UKPCBfSraU8WCwNUvg0oeIaDYlZcUeAiF9eSsJKuiHBur2QDZeLNZJ9k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jYBpm5G8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="jYBpm5G8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 765401F0089D; Wed, 16 Sep 2026 10:34:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789554887; bh=Wj9daQnJXEnpO7Sf+SgclC/+Y3Agiu+biZFpxch9uRY=; h=From:To:Cc:Subject:Date:Reply-To; b=jYBpm5G88OZoPzhA5Wq9k2TKCHf+f5/TQHhipOP8aPBEbhyELaxKlUfSxlrWGuX7S CYXI0s4+LkUzFRc3ptW42AivfZwvC3Wzl3/WZfIpeLTj1xlee5AiTlP37xdr8swSHj d95rU8+8TyvmesqN3jMGxv/7/wjpzcp9QG4t5wkM= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89835: f2fs: avoid NULL checkpoint thread access in sysfs Date: Wed, 16 Sep 2026 11:29:25 +0100 Message-ID: <2026091608-CVE-2026-89835-e271@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2815; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=h24NMY5GIms90wz0n0BcYu0+oMcA4+dFB22nfoy+ERQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmr8ksayxcwSCt+ET9p8eTdoUydnOC9Cr8TFvB/3jm3L exEYGpmRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEykyJxhrkhnDX9z2vLq3O/G 4SUHj0vVCX29wDBXQu/Y5jj7W1brpwSnFxS3ptTJieQCAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio. The Linux kernel CVE team has assigned CVE-2026-89835 to this issue. Affected and fixed versions =========================== Issue introduced in 5.12 with commit e65920661708b7c0f3db45c9cd5d0095034ee37f and fixed in 6.12.110 with commit a6573f3ffc19542de9ebc1a2b1f930fd48ba538c Issue introduced in 5.12 with commit e65920661708b7c0f3db45c9cd5d0095034ee37f and fixed in 6.18.51 with commit aefcec3bebdeed2bff444378122300763325ba23 Issue introduced in 5.12 with commit e65920661708b7c0f3db45c9cd5d0095034ee37f and fixed in 7.2.5 with commit 8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b Issue introduced in 5.12 with commit e65920661708b7c0f3db45c9cd5d0095034ee37f and fixed in 7.3-rc1 with commit 5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89835 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/f2fs/sysfs.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/a6573f3ffc19542de9ebc1a2b1f930fd48ba538c https://git.kernel.org/stable/c/aefcec3bebdeed2bff444378122300763325ba23 https://git.kernel.org/stable/c/8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b https://git.kernel.org/stable/c/5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f