CVE-2026-89839: f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
In the Linux kernel, the following vulnerability has been resolved:
f2fs: use the mount idmap for the owner check in f2fsxattradviseset()
f2fsxattradviseset() calls inodeownerorcapable() with &nopmntidmap before allowing the "system.advise" xattr to be set, instead of the idmap that the VFS passes to the ->set() handler.
f2fs supports idmapped mounts, so on such a mount this checks the caller's fsuid against the unmapped on-disk owner rather than the mapped owner: the actual owner can be wrongly denied with -EPERM and an unrelated caller wrongly allowed. Pass the handler's idmap instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In f2fs_xattr_advise_set(), call inode_owner_or_capable() with the idmap that the VFS passes to the ->set() handler (use the mount idmap) instead of passing &nop_mnt_idmap, so the caller's idmap is used for the owner check before allowing the system.advise xattr to be set.
Linux kernel (F2FS) Use mount idmap for owner check in f2fs_xattr_advise_set() = Pass the handler's idmap instead of &nop_mnt_idmap
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using F2FS with an idmapped mount are exposed. The incorrect ownership check applies when setting the "system.advise" extended attribute through f2fs_xattr_advise_set().
What does an attacker need to exploit it?
The attacker needs access to an affected idmapped F2FS mount and must attempt to set the "system.advise" xattr. Because ownership is checked against the unmapped on-disk owner, an unrelated caller may be incorrectly authorized.
How can I tell whether I am affected?
You are affected if the running kernel contains the vulnerable F2FS ownership check and you use idmapped mounts on F2FS. The issue is specifically observable when setting "system.advise" results in an incorrect permission decision, such as denying the mapped owner or allowing an unrelated caller.