Executive brief
The Linux kernel's f2fs (Flash-Friendly File System) contains a NULL pointer dereference vulnerability in its sysfs interface for managing checkpoint thread I/O priority. On read-only mounts or when no checkpoint thread is running, the ckpt_thread_ioprio sysfs attribute remains writable but may reference a non-existent thread, causing a kernel crash if an attacker writes to this interface. This leads to denial of service through system instability.
Technical details
The vulnerability is a NULL pointer dereference in the f2fs sysfs handler for the ckpt_thread_ioprio attribute. When checkpoint_merge is enabled but no checkpoint thread is running (e.g., on read-only mounts), the ckpt_thread_ioprio store path attempts to call set_task_ioprio() on a NULL task pointer (cprc->f2fs_issue_ckpt). The root cause is insufficient validation: the code checked the MERGE_CHECKPOINT option but not whether the thread actually exists. The fix protects sysfs writes with the s_umount semaphore and changes the validation to check for a non-NULL task pointer instead of just the option flag. Attack vector is local (sysfs write access required), no authentication needed on systems with default sysfs permissions.
Affected products
- Linux Linux kernel Multiple stable branches (commit 5cb33b00c8fbb6e8f1fa3d281c3036d5f7c7c41f and backports)
Timeline
- 2026-09-16: disclosed: CVE-2026-89835 published on NVD
- 2026-08-05: patched: Upstream fix committed by Jaegeuk Kim
- 2026-09-11: patched: Backported to stable kernel branches