CVE-2026-89834 f2fs: fix to migrate all curseg types during free_segment_range
A local attacker with high privileges can trigger out-of-bounds I/O during filesystem shrink, potentially causing denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89834?
CVE-2026-89834 is a memory corruption vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to migrate all curseg types during free_segment_range
In free_segment_range(), the curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC.
Even though these in-memory curseg types are not saved in the on-disk checkpoint header, they still occupy active physical segments at runtime. If an active in-memory curseg happens to be allocated within the segment range being truncated during filesystem shrink, failing to evacuate it will cause subsequent writes to the curseg attempting out-of-bounds I/O on the truncated storage range.
Fix this by expanding the curseg evacuation loop upper bound to NR_CURSEG_TYPE to ensure all active curseg types are safely migrated out of the target range.
Which versions are affected by CVE-2026-89834?
How do I fix CVE-2026-89834?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-89834 being exploited?
There is no known exploitation of CVE-2026-89834 in the wild and no public exploit code.
Sources
Also known as AZL-101523, BELL-CVE-2026-89834, DEBIAN-CVE-2026-89834, GHSA-92fw-gww6-96g8, UBUNTU-CVE-2026-89834.