CVE-2026-89831: f2fs: protect critical_task_priority updates with s_umount
In the Linux kernel, the following vulnerability has been resolved:
f2fs: protect criticaltaskpriority updates with sumount
The sysfs store path already takes sumount for GC thread control entries, and ckptthreadioprio is covered as well.
criticaltaskpriority also updates checkpoint or GC kthread scheduling state, but it is not covered by that serialization. It can race with remount or teardown paths that are stopping those threads.
Protect criticaltaskpriority sysfs writes with sumount too.
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The race is triggered through writes to the F2FS critical_task_priority sysfs attribute. A local actor would need permission to modify that sysfs setting while a remount or filesystem teardown is occurring.
When is a system exposed to the race?
Exposure requires an F2FS filesystem and concurrent activity: a critical_task_priority sysfs update must overlap with a remount or teardown path that stops checkpoint or garbage-collection kernel threads.
What can be done if the fix cannot be deployed immediately?
Restrict write access to the critical_task_priority sysfs attribute and avoid changing it during F2FS remount or unmount operations. Coordinating those operations prevents the described concurrent update and thread-stop race.