{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-89836",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-89836",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-16T10:31:10.233Z",
    "updatedAt": "2026-10-19T08:53:29.553Z",
    "importedAt": "2026-10-24T01:58:35.090Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "f2fs: fix folio_nr_pages() race after put in large folio invalidate",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix folio_nr_pages() race after put in large folio invalidate\n\nOur v6.18 based Android system is continuely suffering livelock and bad\npage stat as shown in[1] which related to broken xarray slot status. By\ninvestigating big folio operations within f2fs, we find below races and\nfix it by get the nr_pages before drop the refcount and folio_lock.\n\nf2fs_get_read_data_folio() calls f2fs_folio_put() before\nfolio_nr_pages() when invalidating a large folio from the page cache.\nThat unlocks the folio and drops the caller reference, leaving a window\nwhere a concurrent truncate or folio split can shrink the compound folio\nor free it before the invalidate range is computed. An undersized range\nthen leaves split sub-folios in mapping->i_pages, which can later\ninteract badly with truncate and reclaim (stale xarray entries and bad\npage state when folio->mapping no longer matches the mapping being\ntruncated).\n\n[1]\nPID: 2594     TASK: ffffff8169b81580  CPU: 7    COMMAND: \"Thread-3\"\n #0 [ffffffc08ef2b8a0] xas_load at ffffffe52d1f42a4\n #1 [ffffffc08ef2b900] find_get_entries at ffffffe52c185798\n #2 [ffffffc08ef2bb60] truncate_inode_pages_range at ffffffe52c19e83c\n #3 [ffffffc08ef2bbc0] truncate_inode_pages_final at ffffffe52c19ec2c\n #4 [ffffffc08ef2bc20] f2fs_evict_inode at ffffffe52c4c8400\n #5 [ffffffc08ef2bcc0] evict at ffffffe52c2de9f4\n #6 [ffffffc08ef2bd00] iput at ffffffe52c2db1b4\n #7 [ffffffc08ef2bd30] dentry_unlink_inode at ffffffe52c2d7204\n #8 [ffffffc08ef2bd50] __dentry_kill at ffffffe52c2d3dcc\n #9 [ffffffc08ef2bd80] dput at ffffffe52c2d3c3c\n #10 [ffffffc08ef2bda0] __fput at ffffffe52c2b0a7c\n #11 [ffffffc08ef2bde0] ____fput at ffffffe52c2b1034\n #12 [ffffffc08ef2bdf0] task_work_run at ffffffe52beea200\n #13 [ffffffc08ef2be20] exit_to_user_mode_loop at ffffffe52bfbc17c\n #14 [ffffffc08ef2be80] el0_svc at ffffffe52d1f8e54\n #15 [ffffffc08ef2beb0] el0t_64_sync_handler at ffffffe52d1f8d10",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "05e65c14ea59a401cec4284e9d612f9d5dc1b3f8",
              "status": "affected",
              "versionType": "git",
              "lessThan": "cc34df18da92f68f9b384c3ae95ad64be46cb5ee"
            },
            {
              "version": "05e65c14ea59a401cec4284e9d612f9d5dc1b3f8",
              "status": "affected",
              "versionType": "git",
              "lessThan": "0dab71381f1b4d12dc2056f8bd5aaa9d93ce9082"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "7.0",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "7.0"
            },
            {
              "version": "7.2.5",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "version": "7.3",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}