{"id":"CVE-2026-89838","state":"PUBLISHED","title":"f2fs: limit recovery filename logging to stored length","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: limit recovery filename logging to stored length\n\nF2FS stores recovery filenames as a length plus a fixed-size i_name\nbuffer.  The buffer is not NUL-terminated, but recover_inode() and\nrecover_dentry() print it with %s.\n\nFor a 255-byte filename, recovery logging can read past i_name into the\nfollowing raw inode fields.\n\nPrint the name with a precision bounded by i_namelen and F2FS_NAME_LEN.","publishedAt":"2026-09-16T10:31:12.746Z","updatedAt":"2026-10-30T12:33:16.337Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"b8ac8b14b9d92dd2e1cb05fa8994f41f701fbf28","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"450ab2e5dbe0ef6e3ed73214256565f6f003d62a","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"3d02c7c8446f5d6793ac67f93bf3f84bf24e3f25","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"e754120f8ede55cc773ade108cf7e5b17c859c46","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"7ab1780074943508534343e1e5e5ab0c9ef9dd7b","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"35c5abccd0924b02ad34126f562d93c8d75b0831","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"317d32e1a8deaf1c01c388badc667334c39e62ca","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"01027b2fcb74dade59fb833b51023f6593b6a9a2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/recovery.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.11","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/recovery.c"]}],"references":["https://git.kernel.org/stable/c/b8ac8b14b9d92dd2e1cb05fa8994f41f701fbf28","https://git.kernel.org/stable/c/450ab2e5dbe0ef6e3ed73214256565f6f003d62a","https://git.kernel.org/stable/c/3d02c7c8446f5d6793ac67f93bf3f84bf24e3f25","https://git.kernel.org/stable/c/e754120f8ede55cc773ade108cf7e5b17c859c46","https://git.kernel.org/stable/c/7ab1780074943508534343e1e5e5ab0c9ef9dd7b","https://git.kernel.org/stable/c/35c5abccd0924b02ad34126f562d93c8d75b0831","https://git.kernel.org/stable/c/317d32e1a8deaf1c01c388badc667334c39e62ca","https://git.kernel.org/stable/c/01027b2fcb74dade59fb833b51023f6593b6a9a2"],"weaknesses":[],"ingestedAt":"2026-10-30T12:52:04.348Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89838.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89838","state":"PUBLISHED","datePublished":"2026-09-16T10:31:12.746Z","dateUpdated":"2026-10-30T12:33:16.337Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.769Z"},"containers":{"cna":{"title":"f2fs: limit recovery filename logging to stored length","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: limit recovery filename logging to stored length\n\nF2FS stores recovery filenames as a length plus a fixed-size i_name\nbuffer.  The buffer is not NUL-terminated, but recover_inode() and\nrecover_dentry() print it with %s.\n\nFor a 255-byte filename, recovery logging can read past i_name into the\nfollowing raw inode fields.\n\nPrint the name with a precision bounded by i_namelen and F2FS_NAME_LEN."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"b8ac8b14b9d92dd2e1cb05fa8994f41f701fbf28","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"450ab2e5dbe0ef6e3ed73214256565f6f003d62a","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"3d02c7c8446f5d6793ac67f93bf3f84bf24e3f25","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"e754120f8ede55cc773ade108cf7e5b17c859c46","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"7ab1780074943508534343e1e5e5ab0c9ef9dd7b","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"35c5abccd0924b02ad34126f562d93c8d75b0831","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"317d32e1a8deaf1c01c388badc667334c39e62ca","versionType":"git"},{"version":"f356fe0cba0e3523e538987916bd2acedd4e6f41","status":"affected","lessThan":"01027b2fcb74dade59fb833b51023f6593b6a9a2","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/recovery.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.11","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.5","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/f2fs/recovery.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b8ac8b14b9d92dd2e1cb05fa8994f41f701fbf28"},{"url":"https://git.kernel.org/stable/c/450ab2e5dbe0ef6e3ed73214256565f6f003d62a"},{"url":"https://git.kernel.org/stable/c/3d02c7c8446f5d6793ac67f93bf3f84bf24e3f25"},{"url":"https://git.kernel.org/stable/c/e754120f8ede55cc773ade108cf7e5b17c859c46"},{"url":"https://git.kernel.org/stable/c/7ab1780074943508534343e1e5e5ab0c9ef9dd7b"},{"url":"https://git.kernel.org/stable/c/35c5abccd0924b02ad34126f562d93c8d75b0831"},{"url":"https://git.kernel.org/stable/c/317d32e1a8deaf1c01c388badc667334c39e62ca"},{"url":"https://git.kernel.org/stable/c/01027b2fcb74dade59fb833b51023f6593b6a9a2"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - recover_inode() and recover_dentry() run only during local f2fs roll-forward in f2fs_fill_super() -> f2fs_recover_fsync_data(). This is a local block filesystem (Android userdata/portable storage), not a network protocol path such as ksmbd or nfsd.\nAC:L - A crafted f2fs image with a 255-byte non-NUL i_name and a pending fsync node makes printk %s over-read deterministically on mount. Roll-forward is default-enabled; no race or attacker-uncontrollable layout is required.\nPR:L - f2fs lacks FS_USERNS_MOUNT, but Android vold auto-mounts f2fs portable/adoptable storage and desktop/kiosk udisks2/polkit mounts removable media for an ordinary console user, so init-namespace root is not required.\nUI:N - The attacker supplies the crafted image; vold/udisks auto-mount runs roll-forward recovery without a separate deliberate victim mount or open. Recovery also fires automatically on the next mount after an unclean shutdown.\nS:U - The over-read and any resulting oops stay in the host kernel address space and security authority. This is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - recover_inode()/recover_dentry() pass the 255-byte, non-NUL-terminated i_name to printk %s with no precision, so vsprintf scans past the field and the rest of the 4KB node folio into adjacent kernel memory and copies it into dmesg, an unbounded OOB read.\nI:N - The defect is a read-only printk over-read of i_name; it does not write kernel memory, corrupt adjacent objects, or provide a control-flow hijack primitive.\nA:H - Unbounded %s scanning off the node folio can walk into unmapped pages or trip KASAN/page-poisoning and oops/panic the kernel during mount recovery, fully denying availability."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:33:16.337Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.11","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.11","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.11","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.11","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.11","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.11","versionEndExcluding":"6.18.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.11","versionEndExcluding":"7.2.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.11","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}