CVE-2026-89834
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range(), the curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. Even though these in-memory curseg types are not saved in the on-disk checkpoint header, they still occupy active physical segments at runtime. If an active in-memory curseg happens to be allocated within the segment range being truncated during filesystem shrink, failing to evacuate it will cause subsequent writes to the curseg attempting out-of-bounds I/O on the truncated storage range. Fix this by expanding the curseg evacuation loop upper bound to NR_CURSEG_TYPE to ensure all active curseg types are safely migrated out of the target range.
Affected versions
Linux kernel versions
5.10
and later are affected. Fixed in
6.12.110,
6.18.51,
7.2.5,
7.3-rc1
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-89834?
CVE-2026-89834 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.10 onward and has been patched in 6.12.110, 6.18.51, 7.2.5 and others. CVE-2026-89834 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89834?
Yes. CVE-2026-89834 has been patched. Fixed versions include 6.12.110, 6.18.51, 7.2.5 and others. If you are running Linux kernel 5.10 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89834 actively exploited?
No. CVE-2026-89834 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.