CVE-2026-89835 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
f2fs: avoid NULL checkpoint thread access in sysfs
checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs.
The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer.
Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Linux kernel's F2FS file system involves a race condition and improper synchronization within the sysfs interface for managing I/O priority settings of the checkpoint merge thread. Specifically, the issue arises when the ckpt_thread_ioprio attribute is written to via sysfs while the filesystem is mounted read-only or during state transitions where the checkpoint thread may not be actively running. In such scenarios, the internal pointer f2fs_issue_ckpt remains NULL because the kernel does not initiate the checkpoint process in a read-only mount context. However, the sysfs write path for ckpt_thread_ioprio proceeds to update the saved I/O priority value and subsequently attempts to apply this setting by calling set_task_ioprio() on the checkpoint thread task structure. Since no active thread exists or is accessible at that moment, dereferencing a NULL pointer leads to a kernel panic or crash, representing a classic null pointer dereference vulnerability.
From a technical perspective, this flaw stems from insufficient locking mechanisms protecting critical data structures during sysfs attribute modifications. The ckpt_thread_ioprio store function updates shared state without holding the s_umount semaphore, which is responsible for serializing mount and unmount operations as well as ensuring that task pointers remain valid throughout their lifecycle. Without this lock, there exists a window where the checkpoint thread might be terminated or not yet initialized while an administrator attempts to modify its I/O priority settings through sysfs. This lack of synchronization allows concurrent access patterns that violate kernel memory safety assumptions, resulting in undefined behavior and potential denial of service conditions for systems relying on stable file system operations.
The operational impact of this vulnerability is primarily a local denial of service. An attacker with the ability to write to specific sysfs entries associated with F2FS mounts can trigger a kernel oops or panic by exploiting the race condition between thread lifecycle management and configuration updates. While remote exploitation is unlikely due to the requirement for local access to device attributes, the severity lies in the potential instability of storage subsystems on affected systems. This could disrupt services dependent on persistent storage integrity if the system crashes unexpectedly during administrative tasks involving F2FS volume tuning or monitoring tools that interact with these sysfs interfaces.
Mitigation strategies involve applying kernel patches that enforce proper locking semantics around sysfs write operations for checkpoint-related attributes. The primary fix includes protecting the ckpt_thread_ioprio store path with s_umount to ensure that the checkpoint thread cannot disappear while its I/O priority is being updated. Additionally, developers should implement checks to verify whether f2fs_issue_ckpt is non-NULL before attempting to call set_task_ioprio(), thereby preventing null pointer dereferences even if synchronization delays occur. Administrators running vulnerable kernels should avoid modifying F2FS sysfs attributes during read-only mounts or periods of high filesystem activity where thread states may be transient.
This vulnerability aligns with CWE-476, which describes a NULL Pointer Dereference error occurring when software incorrectly handles null values, leading to crashes or unexpected behavior. It also relates to ATT&CK technique T1053, specifically Scheduled Task/Job, as sysfs interactions can be automated via scripts that run under cron jobs or systemd timers attempting to optimize I/O performance without considering thread availability states. Proper remediation requires updating the kernel source code to include explicit null checks and robust locking mechanisms around shared resource access points within the F2FS subsystem to maintain system stability during configuration changes.