CVE-2026-89839: f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
f2fs: use the mount idmap for the owner check in f2fsxattradviseset()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Configuration
In f2fs_xattr_advise_set(), call inode_owner_or_capable() with the idmap that the VFS passes to the ->set() handler (use the mount idmap) instead of passing &nop_mnt_idmap, so the caller's idmap is used for the owner check before allowing the system.advise xattr to be set.
Linux kernel (F2FS) Use mount idmap for owner check in f2fs_xattr_advise_set() = Pass the handler's idmap instead of &nop_mnt_idmap
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using F2FS with an idmapped mount are exposed. The incorrect ownership check applies when setting the "system.advise" extended attribute through f2fs_xattr_advise_set().
What does an attacker need to exploit it?
The attacker needs access to an affected idmapped F2FS mount and must attempt to set the "system.advise" xattr. Because ownership is checked against the unmapped on-disk owner, an unrelated caller may be incorrectly authorized.
How can I tell whether I am affected?
You are affected if the running kernel contains the vulnerable F2FS ownership check and you use idmapped mounts on F2FS. The issue is specifically observable when setting "system.advise" results in an incorrect permission decision, such as denying the mapped owner or allowing an unrelated caller.