CVE-2026-89835: f2fs: avoid NULL checkpoint thread access in sysfs
In the Linux kernel, the following vulnerability has been resolved:
f2fs: avoid NULL checkpoint thread access in sysfs
checkpointmerge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fsissueckpt there, but ckptthreadioprio is still writable through sysfs.
The ckptthreadioprio store path updates the saved ioprio value and, when checkpointmerge is enabled, calls settaskioprio() for the checkpoint thread. If cprc->f2fsissueckpt is NULL, that dereferences a NULL task pointer.
Protect ckptthreadioprio sysfs writes with sumount as well, so the checkpoint thread cannot disappear under the store path while updating its ioprio.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.110 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.51 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.5 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to the NULL-pointer dereference?
Linux systems using f2fs are exposed when checkpoint_merge is enabled but no checkpoint merge thread is running. A read-only f2fs mount is specifically identified as a case where the thread is not started.
What action triggers the issue?
An actor able to write the ckpt_thread_ioprio f2fs sysfs attribute can trigger the vulnerable path when checkpoint_merge is enabled and the checkpoint thread pointer is NULL. The write attempts to apply I/O priority to the nonexistent checkpoint thread.
What can be done if the fix cannot be applied immediately?
Avoid writes to the ckpt_thread_ioprio sysfs attribute in configurations where checkpoint_merge is enabled and no checkpoint merge thread is running, including read-only f2fs mounts. Restricting write access to the relevant sysfs interface reduces exposure.
How can an administrator identify an affected configuration?
Check for an f2fs filesystem mounted read-only with checkpoint_merge enabled, and determine whether ckpt_thread_ioprio remains writable through sysfs. That combination is explicitly described as allowing access to a NULL checkpoint-thread pointer.