CVE-2026-89835
In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
Affected versions
Linux kernel versions
5.12
and later are affected. Fixed in
6.12.110,
6.18.51,
7.2.5,
7.3-rc1
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-89835?
CVE-2026-89835 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.12 onward and has been patched in 6.12.110, 6.18.51, 7.2.5 and others. CVE-2026-89835 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-89835?
Yes. CVE-2026-89835 has been patched. Fixed versions include 6.12.110, 6.18.51, 7.2.5 and others. If you are running Linux kernel 5.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-89835 actively exploited?
No. CVE-2026-89835 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.