CVE-2026-89840: f2fs: validate MOVE_RANGE destination size
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate MOVERANGE destination size
F2FSIOCMOVERANGE checks the source range, but not the destination end before updating isize. A source hole can expose this: cloneblkaddrs() skips NULLADDR entries and returns success, so the caller can still extend the destination inode with unchecked posout + len.
Reject destination overflow and use inodenewsizeok() before extending the destination inode.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The issue involves the F2FS_IOC_MOVE_RANGE operation when a source range contains a hole. Because NULL_ADDR entries can be skipped successfully, the destination inode may be extended using an unchecked destination offset plus length.
What should defenders verify when assessing exposure?
Verify whether affected systems use the F2FS filesystem and permit use of the F2FS_IOC_MOVE_RANGE ioctl. Review uses of range-moving operations involving sparse source files or source holes, particularly where the requested destination range could exceed valid file-size limits.
What does the fix change?
The fix rejects destination-size overflow and checks proposed destination inode growth with inode_newsize_ok() before extending i_size.