Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-89835

f2fs: avoid NULL checkpoint thread access in sysfs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • e65920661708b7c0f3db45c9cd5d0095034ee37f to < 54196bcfde998fb37009f50e0ef16498f651f0f9affected
  • e65920661708b7c0f3db45c9cd5d0095034ee37f to < 22760e3e9cecbddc475edc91600787abf407a302affected
  • e65920661708b7c0f3db45c9cd5d0095034ee37f to < a6573f3ffc19542de9ebc1a2b1f930fd48ba538caffected
  • e65920661708b7c0f3db45c9cd5d0095034ee37f to < aefcec3bebdeed2bff444378122300763325ba23affected
  • e65920661708b7c0f3db45c9cd5d0095034ee37f to < 8f3b99c50dd0da1777994ce7c7e60d39b9f60f4baffected
  • e65920661708b7c0f3db45c9cd5d0095034ee37f to < 5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41faffected

Linux Linux

Default version status: affected

  • 5.12affected
  • 0 to < 5.12unaffected
  • 6.1.191 to ≤ 6.1.*unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.51 to ≤ 6.18.*unaffected
  • 7.2.5 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References