CVE-2026-89834
CVE CVE-2026-89834EUVD EUVD-2026-80434Published 2026-09-16T10:31:07.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range(), the curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. Even though these in-memory curseg types are not saved in the on-disk checkpoint header, they still occupy active physical segments at runtime. If an active in-memory curseg happens to be allocated within the segment range being truncated during filesystem shrink, failing to evacuate it will cause subsequent writes to the curseg attempting out-of-bounds I/O on the truncated storage range. Fix this by expanding the curseg evacuation loop upper bound to NR_CURSEG_TYPE to ensure all active curseg types are safely migrated out of the target range.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux d0b9e42ab6155dc05fc83f00af9f45d4dd02264d <b8ae1228c153622afa71a179c9d4dc268117e0f0; patch: 0; d0b9e42ab6155dc05fc83f00af9f45d4dd02264d <3b85edf3391f3e1f624f409a7d2d239885f567b7; patch: 7.3-rc1; 5.10; patch: 7.2.5; patch: 6.12.110; d0b9e42ab6155dc05fc83f00af9f45d4dd02264d <b9776094aa7118e8e5dfdcd791ffc8330c5ca408; patch: 6.18.51; d0b9e42ab6155dc05fc83f00af9f45d4dd02264d <8ec06f50ddd8d201bd7e55b896ae28ed9d4cb7d1
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.