EUVD-2026-80429
GHSA-4f5r-rjrj-j99g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local mount of a crafted f2fs image (AV:L, AC:H, PR:L); a bypassed footer sanity check most plausibly yields a crash (A:H) with limited, uncertain confidentiality/integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer()
Otherwise in f2fs_sanity_check_node_footer(), it will check the same nid incorrectly.
AnalysisAI
Incorrect node-block validation in the Linux kernel's f2fs filesystem causes f2fs_sanity_check_node_footer() to be invoked with the wrong folio index, so the sanity check re-validates the same nid instead of the node actually being read, allowing a local user who is permitted to mount a crafted or corrupted f2fs volume to bypass the intended footer validation and trigger out-of-range metadata access - most plausibly a kernel crash or denial of service. The affected code path is reachable only when an attacker-influenced f2fs image is mounted (CVSS AV:L, PR:L), and exploitation requires supplying malicious on-disk metadata, which raises real attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local access to the target system with the ability to mount an f2fs filesystem (CVSS AV:L, PR:L), plus a crafted or corrupted f2fs volume whose node footer triggers the mis-validated nid check - the flaw lives in f2fs_sanity_check_node_footer() and is only reached during node-block validation, so it does not affect systems that never mount attacker-influenced f2fs images. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-style CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8, HIGH) is the boilerplate full-triad scoring that the Linux CNA applies to nearly all kernel commits, and it materially overstates this specific fix. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: apply the upstream f2fs fix by upgrading to Linux 6.18.51, 7.2.5, or 7.3-rc1 (or newer), or cherry-pick the stable commits a984446aa9d5b787afa3023fc7b44017b80fe3bc, 7e188e9f9437ab47c3237d609f1b26348d6fea1a, and 0b196c07407f48a41cd9741cf53e10cb1e23d2e5 from git.kernel.org; distributions should track their kernel security update streams for the corresponding backports, and details are mirrored at https://nvd.nist.gov/vuln/detail/CVE-2026-89829. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux hosts, appliances, and container hosts that use or auto-mount f2fs volumes, and confirm in parallel whether non-privileged or semi-trusted local accounts hold mount capability via sudoers, capabilities, container runtimes, or unprivileged user namespace settings; where f2fs is not needed, block the module from loading and disable unprivileged mounts as an immediate stopgap. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today