CVE-2026-89838

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89838
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89838.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-89838
Downstream
Related
Published
2026-09-16T10:31:12Z
Modified
2026-11-01T02:32:41Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
f2fs: limit recovery filename logging to stored length
Details

In the Linux kernel, the following vulnerability has been resolved:

f2fs: limit recovery filename logging to stored length

F2FS stores recovery filenames as a length plus a fixed-size i_name buffer. The buffer is not NUL-terminated, but recover_inode() and recover_dentry() print it with %s.

For a 255-byte filename, recovery logging can read past i_name into the following raw inode fields.

Print the name with a precision bounded by i_namelen and F2FS_NAME_LEN.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89838.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
f356fe0cba0e3523e538987916bd2acedd4e6f41
Fixed
b8ac8b14b9d92dd2e1cb05fa8994f41f701fbf28
Fixed
450ab2e5dbe0ef6e3ed73214256565f6f003d62a
Fixed
3d02c7c8446f5d6793ac67f93bf3f84bf24e3f25
Fixed
e754120f8ede55cc773ade108cf7e5b17c859c46
Fixed
7ab1780074943508534343e1e5e5ab0c9ef9dd7b
Fixed
35c5abccd0924b02ad34126f562d93c8d75b0831
Fixed
317d32e1a8deaf1c01c388badc667334c39e62ca
Fixed
01027b2fcb74dade59fb833b51023f6593b6a9a2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89838.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.11.0
Fixed
5.10.273
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.224
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.191
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.112
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89838.json"