CVE-2026-89830 f2fs: fix valid block count leak on data block allocation failure
A local attacker can cause a permanent block count leak in the f2fs filesystem, leading to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89830?
CVE-2026-89830 is a denial of service vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix valid block count leak on data block allocation failure
In __allocate_data_block(), when allocating a new data block (dn->data_blkaddr == NULL_ADDR), inc_valid_block_count() is called first to increment total_valid_block_count and i_blocks. If the subsequent f2fs_allocate_data_block() fails, the function returns the error directly without rolling back the already-incremented block counts, causing a permanent leak.
Fix this by calling dec_valid_block_count() to undo the increment before returning the error. The condition old_blkaddr == NULL_ADDR precisely identifies the case where inc_valid_block_count() was called.
Which versions are affected by CVE-2026-89830?
How do I fix CVE-2026-89830?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89830 being exploited?
There is no known exploitation of CVE-2026-89830 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89830, DEBIAN-CVE-2026-89830, GHSA-c5cf-c6gm-hv9c, UBUNTU-CVE-2026-89830.