UBUNTU-CVE-2026-89834: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during freesegmentrange In freesegmentrange(), the curseg evacuation loop only iterates up to NRCURSEGPERSISTTYPE (0..5), missing non-persistent in-memory curseg types such as CURSEGCOLDDATAPINNED and CURSEGALLDATAATGC. Even though these in-memory curseg types are not saved in the on-disk checkpoint header, they still occupy active physical segments at runtime. If an active in-memory curseg happens to be allocated within the segment range being truncated during filesystem shrink, failing to evacuate it will cause subsequent writes to the curseg attempting out-of-bounds I/O on the truncated storage range. Fix this by expanding the curseg evacuation loop upper bound to NRCURSEGTYPE to ensure all active curseg types are safely migrated out of the target range.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Expand the curseg evacuation loop upper bound from NR_CURSEG_PERSIST_TYPE to NR_CURSEG_TYPE so all active curseg types, including CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC, are migrated during free_segment_range().
Linux kernel f2fs curseg evacuation loop upper bound in free_segment_range() = NR_CURSEG_TYPE
Event History
Frequently Asked Questions
Which Ubuntu kernel package variants are listed as affected?
The affected software list includes ubuntu/linux, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-riscv, and ubuntu/linux-gkeop.