{
  "cveId": "CVE-2026-89836",
  "url": "https://patchblox.com/security/cve/CVE-2026-89836",
  "summary": "CVE-2026-89836 is fixed in linux on 1 platform by DEBIAN-CVE-2026-89836 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix folio_nr_pages() race after put in lar...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix folio_nr_pages() race after put in large folio invalidate  Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in[1] which related to broken xarray slot status. By investigating big folio operations within f2fs, we find below races and fix it by get the nr_pages before drop the refcount and folio_lock.  f2fs_get_read_data_folio() calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio from the page cache. That unlocks the folio and drops the caller reference, leaving a window where a concurrent truncate or folio split can shrink the compound folio or free it before the invalidate range is computed. An undersized range then leaves split sub-folios in mapping-\u003Ei_pages, which can later interact badly with truncate and reclaim (stale xarray entries and bad page state when folio-\u003Emapping no longer matches the mapping being truncated).  [1] PID: 2594     TASK: ffffff8169b81580  CPU: 7    COMMAND: \u0022Thread-3\u0022  #0 [ffffffc08ef2b8a0] xas_load at ffffffe52d1f42a4  #1 [ffffffc08ef2b900] find_get_entries at ffffffe52c185798  #2 [ffffffc08ef2bb60] truncate_inode_pages_range at ffffffe52c19e83c  #3 [ffffffc08ef2bbc0] truncate_inode_pages_final at ffffffe52c19ec2c  #4 [ffffffc08ef2bc20] f2fs_evict_inode at ffffffe52c4c8400  #5 [ffffffc08ef2bcc0] evict at ffffffe52c2de9f4  #6 [ffffffc08ef2bd00] iput at ffffffe52c2db1b4  #7 [ffffffc08ef2bd30] dentry_unlink_inode at ffffffe52c2d7204  #8 [ffffffc08ef2bd50] __dentry_kill at ffffffe52c2d3dcc  #9 [ffffffc08ef2bd80] dput at ffffffe52c2d3c3c  #10 [ffffffc08ef2bda0] __fput at ffffffe52c2b0a7c  #11 [ffffffc08ef2bde0] ____fput at ffffffe52c2b1034  #12 [ffffffc08ef2bdf0] task_work_run at ffffffe52beea200  #13 [ffffffc08ef2be20] exit_to_user_mode_loop at ffffffe52bfbc17c  #14 [ffffffc08ef2be80] el0_svc at ffffffe52d1f8e54  #15 [ffffffc08ef2beb0] el0t_64_sync_handler at ffffffe52d1f8d10",
  "published": "2026-09-16T11:16:50Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00165,
  "epssPercentile": 0.05752,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-89836",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-89836",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}