f2fs: avoid NULL checkpoint thread access in sysfs
In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.1.191, 6.12.110, 6.18.51, 6.6.160, 7.2.5
- CVEs
- CVE-2026-89835
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 01:23 UTC · Revision 1
Source evidence
f2fs: avoid NULL checkpoint thread access in sysfs
core-osv · Original sourcePublished 16 Sept 2026, 10:31 UTC
In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
osv:CVE-2026-89835
Kernel
Fixed versions: 6.1.191, 6.6.160, 6.12.110, 6.18.51, 7.2.5
Complete source record
{
"id": "0c6587a401449acc480da102c6fb8a5e748a0084b8bb17a4fbcbb5f2440180ee",
"url": "https://osv.dev/vulnerability/CVE-2026-89835",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "f2fs: avoid NULL checkpoint thread access in sysfs",
"summary": "In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value and, when checkpoint_merge is enabled, calls set_task_ioprio() for the checkpoint thread. If cprc->f2fs_issue_ckpt is NULL, that dereferences a NULL task pointer. Protect ckpt_thread_ioprio sysfs writes with s_umount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.",
"evidence": "osv:CVE-2026-89835",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.191",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.160",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.110",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.51",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-89835",
"aliases": [
"CVE-2026-89835"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "e65920661708b7c0f3db45c9cd5d0095034ee37f"
},
{
"fixed": "54196bcfde998fb37009f50e0ef16498f651f0f9"
},
{
"fixed": "22760e3e9cecbddc475edc91600787abf407a302"
},
{
"fixed": "a6573f3ffc19542de9ebc1a2b1f930fd48ba538c"
},
{
"fixed": "aefcec3bebdeed2bff444378122300763325ba23"
},
{
"fixed": "8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b"
},
{
"fixed": "5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89835.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.12.0"
},
{
"fixed": "6.1.191"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.160"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.110"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.51"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.5"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89835.json"
}
}
],
"modified": "2026-11-01T02:30:36.354809169Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/22760e3e9cecbddc475edc91600787abf407a302",
"https://git.kernel.org/stable/c/54196bcfde998fb37009f50e0ef16498f651f0f9",
"https://git.kernel.org/stable/c/5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f",
"https://git.kernel.org/stable/c/8f3b99c50dd0da1777994ce7c7e60d39b9f60f4b",
"https://git.kernel.org/stable/c/a6573f3ffc19542de9ebc1a2b1f930fd48ba538c",
"https://git.kernel.org/stable/c/aefcec3bebdeed2bff444378122300763325ba23",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89835.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-89835",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89835.json"
}
},
"related_cves": [
{
"value": "CVE-2026-89835",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 491554,
"published_at": "2026-09-16T10:31:08.636+00:00"
}