CVE-2026-89837 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix dentry folio leak in find_in_level
find_in_level() gets a dentry folio with f2fs_find_data_folio() before calling find_in_block(). If find_in_block() returns an error, the function stores the error in res_folio and breaks out of the loop without dropping the dentry folio.
This leaks the folio reference on the find_in_block() error path. Drop the dentry folio before returning the error to the caller.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel's F2FS file system contains a resource management flaw within the directory entry lookup logic, specifically in the function responsible for traversing hash levels during inode resolution. This vulnerability arises from an improper handling of reference counts when dealing with memory folios, which are contiguous blocks of physical memory used to manage page cache data structures. The core issue is located in the find_in_level routine, where the system attempts to locate a specific directory entry by first acquiring a dentry folio via f2fs_find_data_folio and subsequently searching within that block using find_in_block. Under normal operational conditions, this sequence proceeds without incident; however, when find_in_block encounters an error condition such as data corruption or I/O failure, the control flow diverges into an error handling path that fails to release the previously acquired resource.
This oversight results in a memory leak where the reference count for the dentry folio is not decremented before the function returns the error code to its caller. In kernel space, every allocation of a page or folio structure requires a corresponding deallocation to prevent system-wide resource exhaustion over time. While a single instance of this leak may appear negligible in terms of immediate memory consumption, repeated occurrences during high-frequency directory operations can lead to significant cumulative waste. This type of defect is classified under CWE-401, which describes the failure to release allocated memory after it has been used, leading to resource leakage that degrades system performance and stability over extended periods.
The operational impact of this vulnerability extends beyond simple memory inefficiency. As the kernel continues to allocate folios without releasing them on error paths, available free memory decreases, potentially triggering aggressive garbage collection or causing out-of-memory conditions in constrained environments such as embedded devices or containers running F2FS volumes. Furthermore, if the leaked folio holds locks or other synchronization primitives, it could theoretically lead to deadlocks or race conditions during subsequent access attempts to the same directory structure. Although this is not a direct privilege escalation vector, the degradation of system stability can indirectly affect availability and reliability, making it a critical concern for systems relying on consistent file system performance under error-prone conditions like disk failures or corrupted metadata.
To mitigate this vulnerability, developers must ensure that all code paths in find_in_level properly balance resource acquisition with release operations. The specific fix involves inserting a call to drop the dentry folio reference immediately before returning an error status from the loop when find_in_block fails. This ensures that regardless of whether the lookup succeeds or encounters an internal block-level error, the kernel maintains accurate accounting of allocated memory structures. System administrators and users should apply available kernel patches that include this correction to restore proper resource management behavior within the F2FS subsystem. Regular updates to the Linux kernel are essential for maintaining these integrity checks, as they address both security implications related to availability and general system robustness against file system errors.