CVE-2026-89835 f2fs: avoid NULL checkpoint thread access in sysfs
A local attacker with write access to sysfs can trigger a NULL pointer dereference in the Linux kernel f2fs module, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89835?
CVE-2026-89835 is a vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: avoid NULL checkpoint thread access in sysfs
checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs.
The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer.
Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
Which versions are affected by CVE-2026-89835?
How do I fix CVE-2026-89835?
Apply the vendor's patch.
Is CVE-2026-89835 being exploited?
There is no known exploitation of CVE-2026-89835 in the wild and no public exploit code.
Sources
Also known as AZL-101379, BELL-CVE-2026-89835, DEBIAN-CVE-2026-89835, GHSA-2hjf-mqww-7576, UBUNTU-CVE-2026-89835.