UBUNTU-CVE-2026-89830: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In allocatedatablock(), when allocating a new data block (dn->datablkaddr == NULLADDR), incvalidblockcount() is called first to increment totalvalidblockcount and iblocks. If the subsequent f2fsallocatedatablock() fails, the function returns the error directly without rolling back the already-incremented block counts, causing a permanent leak. Fix this by calling decvalidblockcount() to undo the increment before returning the error. The condition oldblkaddr == NULLADDR precisely identifies the case where incvalidblockcount() was called.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Modify __allocate_data_block() so that when f2fs_allocate_data_block() fails after inc_valid_block_count(), it calls dec_valid_block_count() before returning the error; use old_blkaddr == NULL_ADDR to identify that inc_valid_block_count() was called.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using an affected listed Ubuntu kernel package and the F2FS filesystem may be exposed. The issue occurs in the F2FS data-block allocation path.
What must happen for the block-count leak to occur?
A new data block must be allocated, causing the valid block counts to be incremented, and the subsequent data-block allocation must fail. The failure path then returns without undoing those count increments.
What is the impact of a successful trigger?
The filesystem's total valid block count and the inode's i_blocks count remain incremented even though the data-block allocation failed. This creates a permanent block-count leak.