# CVE-2026-89836: linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix folio_nr_pages() race after put in lar...

CVE-2026-89836 is fixed in linux on 1 platform by DEBIAN-CVE-2026-89836 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-89836
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 16, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix folio_nr_pages() race after put in large folio invalidate  Our v6.18 based Android system is continuely suffering livelock and bad page stat as shown in[1] which related to broken xarray slot status. By investigating big folio operations within f2fs, we find below races and fix it by get the nr_pages before drop the refcount and folio_lock.  f2fs_get_read_data_folio() calls f2fs_folio_put() before folio_nr_pages() when invalidating a large folio from the page cache. That unlocks the folio and drops the caller reference, leaving a window where a concurrent truncate or folio split can shrink the compound folio or free it before the invalidate range is computed. An undersized range then leaves split sub-folios in mapping->i_pages, which can later interact badly with truncate and reclaim (stale xarray entries and bad page state when folio->mapping no longer matches the mapping being truncated).  [1] PID: 2594     TASK: ffffff8169b81580  CPU: 7    COMMAND: "Thread-3"  #0 [ffffffc08ef2b8a0] xas_load at ffffffe52d1f42a4  #1 [ffffffc08ef2b900] find_get_entries at ffffffe52c185798  #2 [ffffffc08ef2bb60] truncate_inode_pages_range at ffffffe52c19e83c  #3 [ffffffc08ef2bbc0] truncate_inode_pages_final at ffffffe52c19ec2c  #4 [ffffffc08ef2bc20] f2fs_evict_inode at ffffffe52c4c8400  #5 [ffffffc08ef2bcc0] evict at ffffffe52c2de9f4  #6 [ffffffc08ef2bd00] iput at ffffffe52c2db1b4  #7 [ffffffc08ef2bd30] dentry_unlink_inode at ffffffe52c2d7204  #8 [ffffffc08ef2bd50] __dentry_kill at ffffffe52c2d3dcc  #9 [ffffffc08ef2bd80] dput at ffffffe52c2d3c3c  #10 [ffffffc08ef2bda0] __fput at ffffffe52c2b0a7c  #11 [ffffffc08ef2bde0] ____fput at ffffffe52c2b1034  #12 [ffffffc08ef2bdf0] task_work_run at ffffffe52beea200  #13 [ffffffc08ef2be20] exit_to_user_mode_loop at ffffffe52bfbc17c  #14 [ffffffc08ef2be80] el0_svc at ffffffe52d1f8e54  #15 [ffffffc08ef2beb0] el0t_64_sync_handler at ffffffe52d1f8d10

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-89836](https://patchblox.com/security/data/fix/linux/debian-cve-2026-89836.md) | Sep 23, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.