CVE-2026-89840

f2fs: validate MOVE_RANGE destination size

State: Published
Severity: 7.1 High
Published: Sep 16, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: validate MOVE_RANGE destination size

F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end before updating i_size. A source hole can expose this: __clone_blkaddrs() skips NULL_ADDR entries and returns success, so the caller can still extend the destination inode with unchecked pos_out + len.

Reject destination overflow and use inode_newsize_ok() before extending the destination inode.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before 454de20a5a36c000b75f49337aae8c92045c5242Affected 4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before 54c587f3f95ce2d6932a16566db83f73cc4313e1Affected 4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before bca61ee5192ea47003722486ae9588a2a4bb47b6Affected 4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before db13064669526494cd78ba3a4394063b740e940cAffected 4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before dcae1eeda53149f219dd6af93b3083b7271c1c63Affected 4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before e533889fc26aea0cd83c90327063f272061dd820Affected
LinuxLinux	4.8Affected before 4.8Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before 454de20a5a36c000b75f49337aae8c92045c5242Affected
4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before 54c587f3f95ce2d6932a16566db83f73cc4313e1Affected
4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before bca61ee5192ea47003722486ae9588a2a4bb47b6Affected
4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before db13064669526494cd78ba3a4394063b740e940cAffected
4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before dcae1eeda53149f219dd6af93b3083b7271c1c63Affected
4dd6f977fc778e5a0da604e5f8cb2f36d163d27b to before e533889fc26aea0cd83c90327063f272061dd820Affected

LinuxLinux

4.8Affected
before 4.8Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.