CVE-2026-89840 f2fs: validate MOVE_RANGE destination size
A missing validation in the Linux kernel F2FS filesystem allows attackers to corrupt file sizes or cause denial of service via crafted MOVE_RANGE operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89840?
CVE-2026-89840 is a high-severity vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate MOVE_RANGE destination size
F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.
Reject destination overflow and use inode_newsize_ok() before extending the destination inode.
Which versions are affected by CVE-2026-89840?
How do I fix CVE-2026-89840?
Apply the vendor's patch.
Is CVE-2026-89840 being exploited?
There is no known exploitation of CVE-2026-89840 in the wild and no public exploit code.
Sources
Also known as AZL-101235, BELL-CVE-2026-89840, DEBIAN-CVE-2026-89840, GHSA-6fmr-6rhp-m3p8, UBUNTU-CVE-2026-89840.