CVE-2026-89838 f2fs: limit recovery filename logging to stored length
An attacker can read adjacent kernel memory via F2FS recovery logs due to missing length checks on non-null-terminated filenames.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89838?
CVE-2026-89838 is a high-severity vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: limit recovery filename logging to stored length
F2FS stores recovery filenames as a length plus a fixed-size i_name buffer. The buffer is not NUL-terminated, but recover_inode() and recover_dentry() print it with %s.
For a 255-byte filename, recovery logging can read past i_name into the following raw inode fields.
Print the name with a precision bounded by i_namelen and F2FS_NAME_LEN.
Which versions are affected by CVE-2026-89838?
How do I fix CVE-2026-89838?
Apply the vendor's patch.
Is CVE-2026-89838 being exploited?
There is no known exploitation of CVE-2026-89838 in the wild and no public exploit code.
Sources
Also known as AZL-101139, BELL-CVE-2026-89838, DEBIAN-CVE-2026-89838, GHSA-jfgp-78p5-g7hq, UBUNTU-CVE-2026-89838.