CVE-2026-89838

f2fs: limit recovery filename logging to stored length

State: Published
Severity: 7.1 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: limit recovery filename logging to stored length

F2FS stores recovery filenames as a length plus a fixed-size i_name buffer. The buffer is not NUL-terminated, but recover_inode() and recover_dentry() print it with %s.

For a 255-byte filename, recovery logging can read past i_name into the following raw inode fields.

Print the name with a precision bounded by i_namelen and F2FS_NAME_LEN.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f356fe0cba0e3523e538987916bd2acedd4e6f41 to before b8ac8b14b9d92dd2e1cb05fa8994f41f701fbf28Affected f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 450ab2e5dbe0ef6e3ed73214256565f6f003d62aAffected f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 3d02c7c8446f5d6793ac67f93bf3f84bf24e3f25Affected f356fe0cba0e3523e538987916bd2acedd4e6f41 to before e754120f8ede55cc773ade108cf7e5b17c859c46Affected f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 7ab1780074943508534343e1e5e5ab0c9ef9dd7bAffected f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 35c5abccd0924b02ad34126f562d93c8d75b0831Affected f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 317d32e1a8deaf1c01c388badc667334c39e62caAffected f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 01027b2fcb74dade59fb833b51023f6593b6a9a2Affected
LinuxLinux	3.11Affected before 3.11Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f356fe0cba0e3523e538987916bd2acedd4e6f41 to before b8ac8b14b9d92dd2e1cb05fa8994f41f701fbf28Affected
f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 450ab2e5dbe0ef6e3ed73214256565f6f003d62aAffected
f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 3d02c7c8446f5d6793ac67f93bf3f84bf24e3f25Affected
f356fe0cba0e3523e538987916bd2acedd4e6f41 to before e754120f8ede55cc773ade108cf7e5b17c859c46Affected
f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 7ab1780074943508534343e1e5e5ab0c9ef9dd7bAffected
f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 35c5abccd0924b02ad34126f562d93c8d75b0831Affected
f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 317d32e1a8deaf1c01c388badc667334c39e62caAffected
f356fe0cba0e3523e538987916bd2acedd4e6f41 to before 01027b2fcb74dade59fb833b51023f6593b6a9a2Affected

LinuxLinux

3.11Affected
before 3.11Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.