Linux Kernel up to 7.2.4 f2fs race condition

Summaryinfo

A vulnerability classified as very critical was found in Linux Kernel up to 7.2.4. This vulnerability affects unknown code of the component f2fs. Such manipulation leads to race condition. This vulnerability is referenced as CVE-2026-89831. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.2.4. Affected by this issue is an unknown function of the component f2fs. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_priority updates with s_umount The sysfs store path already takes s_umount for GC thread control entries, and ckpt_thread_ioprio is covered as well. critical_task_priority also updates checkpoint or GC kthread scheduling state, but it is not covered by that serialization. It can race with remount or teardown paths that are stopping those threads. Protect critical_task_priority sysfs writes with s_umount too.

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2026-89831 since 09/11/2026. The exploitation is known to be easy. Local access is required to approach this attack. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/16/2026).

Upgrading to version 7.2.5 or 7.3-rc1 eliminates this vulnerability. Applying the patch bee6dfcc111b1dffdb3e13d73b7028b699fa0165/8e4692c6c165e81b2cbb847d8da4b45a53483b33 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion