CVE-2026-89835

f2fs: avoid NULL checkpoint thread access in sysfs

Published Sep 16, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: avoid NULL checkpoint thread access in sysfs

checkpoint_merge can be enabled even when no checkpoint merge thread is
running. A read-only mount is one case: f2fs does not start
f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through
sysfs.

The ckpt_thread_ioprio store path updates the saved ioprio value and,
when checkpoint_merge is enabled, calls set_task_ioprio() for the
checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a
NULL task pointer.

Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the
checkpoint thread cannot disappear under the store path while updating
its ioprio.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e65920661708b7c0f3db45c9cd5d0095034ee37f`	affected	< 54196bcfde998fb37009f50e0ef16498f651f0f9
`e65920661708b7c0f3db45c9cd5d0095034ee37f`	affected	< 22760e3e9cecbddc475edc91600787abf407a302
`e65920661708b7c0f3db45c9cd5d0095034ee37f`	affected	< a6573f3ffc19542de9ebc1a2b1f930fd48ba538c
`e65920661708b7c0f3db45c9cd5d0095034ee37f`	affected	< aefcec3bebdeed2bff444378122300763325ba23
`e65920661708b7c0f3db45c9cd5d0095034ee37f`	affected	< 8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b
`e65920661708b7c0f3db45c9cd5d0095034ee37f`	affected	< 5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f

Linux

affected

Version	Status	Constraints
`5.12`	affected	—
`0`	unaffected	< 5.12
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.5`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[e65920661708b7c0f3db45c9cd5d0095034ee37f,a6573f3ffc19542de9ebc1a2b1f930fd48ba538c)`	affected	code_commit	—
`[e65920661708b7c0f3db45c9cd5d0095034ee37f,aefcec3bebdeed2bff444378122300763325ba23)`	affected	code_commit	—
`[e65920661708b7c0f3db45c9cd5d0095034ee37f,8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b)`	affected	code_commit	—
`[e65920661708b7c0f3db45c9cd5d0095034ee37f,5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.12`	affected	generic	—
`[0,5.12)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.5,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.215% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/22760e3e9cecbddc475edc91600787abf407a302
https://git.kernel.org/stable/c/54196bcfde998fb37009f50e0ef16498f651f0f9
https://git.kernel.org/stable/c/5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f
https://git.kernel.org/stable/c/8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b
https://git.kernel.org/stable/c/a6573f3ffc19542de9ebc1a2b1f930fd48ba538c
https://git.kernel.org/stable/c/aefcec3bebdeed2bff444378122300763325ba23

History

Oct 30, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/54196bcfde998fb37009f50e0ef16498f651f0f9

Oct 21, 2026 1:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/22760e3e9cecbddc475edc91600787abf407a302

Sep 18, 2026 10:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sep 16, 2026 10:45 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
Title		f2fs: avoid NULL checkpoint thread access in sysfs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f https://git.kernel.org/stable/c/8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b https://git.kernel.org/stable/c/a6573f3ffc19542de9ebc1a2b1f930fd48ba538c https://git.kernel.org/stable/c/aefcec3bebdeed2bff444378122300763325ba23